In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries.
To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb.
This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernelUpgrade perfUpgrade python3-perfUpgrade bpftoolUpgrade kernel-debugUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-cross-headersUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-rt-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-zfcpdumpUpgrade kernel-headersUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-modulesUpgrade kernel-modulesUpgrade kernel-docUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-debug-develUpgrade kernel-tools-libs-develUpgrade kernel-coreUpgrade kernel-zfcpdump-core | Aug 12, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.349-266.564Upgrade kernelUpgrade kernel-livepatch-5.15.145-95.156Upgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.205-195.804 | Jun 26, 2024 | May 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-libbpf-develUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernelUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade perfUpgrade kernel-libbpfUpgrade kernel-livepatch-6.1.66-91.160Upgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade python3-perfUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-modules-extra | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Aug 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 12, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-rt-debugUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-modulesUpgrade kernel-rt-debuginfoUpgrade kernel-cross-headersUpgrade kernel-debug-develUpgrade python3-perf-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-debuginfoUpgrade kernel-rt-kvmUpgrade kernel-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-rt-develUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-rt-debug-modules-extraUpgrade perf-debuginfoUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade kernel-rt-modulesUpgrade kernel-rtUpgrade kernel-toolsUpgrade perfUpgrade kernel-rt-debug-develUpgrade python3-perf | Aug 22, 2024 | May 21, 2024 |
| Suse | — | Upgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade dtb-marvellUpgrade kernel-defaultUpgrade kernel-azure-livepatch-develUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade kernel-64kb-optionalUpgrade kernel-default-livepatchUpgrade dlm-kmp-azureUpgrade kernel-source-rtUpgrade kernel-rt-extraUpgrade kernel-default-manUpgrade kernel-default-baseUpgrade kernel-obs-qaUpgrade kernel-default-livepatch-develUpgrade kernel-obs-buildUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-docsUpgrade kernel-macrosUpgrade kernel-azure-baseUpgrade kernel-azure-extraUpgrade kselftests-kmp-defaultUpgrade dtb-apmUpgrade kernel-rt_debugUpgrade kernel-rt-vdsoUpgrade dtb-appleUpgrade dtb-nvidiaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-develUpgrade kselftests-kmp-rtUpgrade dtb-socionextUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade dtb-sprdUpgrade kernel-rt-optionalUpgrade kernel-azure-vdsoUpgrade kernel-default-extraUpgrade dlm-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade dtb-amlogicUpgrade kernel-docs-htmlUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade dtb-broadcomUpgrade dtb-renesasUpgrade kernel-azureUpgrade kselftests-kmp-64kbUpgrade dtb-alteraUpgrade kernel-64kb-extraUpgrade kernel-devel-rtUpgrade kernel-symsUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade dtb-xilinxUpgrade dtb-freescaleUpgrade kernel-azure-optionalUpgrade kernel-rtUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-caviumUpgrade kernel-develUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade dtb-mediatekUpgrade kernel-sourceUpgrade kernel-syms-azureUpgrade kernel-default-develUpgrade dtb-qcomUpgrade dtb-amazonUpgrade gfs2-kmp-64kbUpgrade kernel-rt_debug-develUpgrade reiserfs-kmp-azureUpgrade kernel-debugUpgrade dtb-armUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade dtb-rockchipUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-default-optionalUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-develUpgrade kernel-debug-vdsoUpgrade dtb-exynosUpgrade dtb-allwinner | Jun 12, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1120-kvmUpgrade linux-image-oemUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1131-oracleUpgrade linux-image-kvmUpgrade linux-image-5.4.0-1079-ibmUpgrade linux-image-5.4.0-1092-bluefieldUpgrade linux-image-azureUpgrade linux-image-aws-lts-20.04Upgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1099-gkeopUpgrade linux-image-awsUpgrade linux-image-5.4.0-195-genericUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-virtualUpgrade linux-image-5.4.0-1043-iotUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1136-gcpUpgrade linux-image-5.4.0-1132-awsUpgrade linux-image-gkeop-5.4Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.4.0-1116-raspiUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oracleUpgrade linux-image-5.4.0-195-lowlatencyUpgrade linux-image-genericUpgrade linux-image-5.4.0-1051-xilinx-zynqmpUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-195-generic-lpaeUpgrade linux-image-raspi2Upgrade linux-image-generic-lpaeUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-gcpUpgrade linux-image-gkeopUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1137-azureUpgrade linux-image-raspi2-hwe-18.04Upgrade linux-image-bluefield | Sep 13, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub