In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
There is an use-after-free problem triggered by following process:
P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset <- nullptr deference (use-after-free) !!! rcu_read_unlock
[ 502.714379] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 502.715260] #PF: supervisor read access in kernel mode [ 502.715903] #PF: error_code(0x0000) - not-present page [ 502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Oops: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Call Trace: [ 502.733193] __blk_add_trace.cold+0x137/0x1a3 [ 502.733734] blk_add_trace_rq+0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.742704] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100
Reproduce method: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb, BLKTRACESTART)
echo 0 > /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free()
ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out)
Remove blk_trace from running_list before calling blk_trace_free() by sysfs if blk_trace is at Blktrace_running state.
CVSS Details
- CVSS 3.1 Base Score: 6.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade python-perfUpgrade bpftoolUpgrade kernel-livepatch-4.14.252-195.481Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-livepatch-5.10.75-79.358Upgrade kernel-toolsUpgrade kernelUpgrade kernel-headersUpgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfo-common-aarch64 | Mar 14, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade dlm-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-default-vdsoUpgrade kernel-default-optionalUpgrade dtb-mediatekUpgrade kernel-rtUpgrade kernel-azure-develUpgrade kernel-azureUpgrade kselftests-kmp-rtUpgrade kernel-source-vanillaUpgrade dtb-qcomUpgrade dtb-xilinxUpgrade kernel-rt-vdsoUpgrade kernel-docsUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade kernel-default-baseUpgrade kselftests-kmp-defaultUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-preemptUpgrade dlm-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-vdsoUpgrade kernel-defaultUpgrade kernel-64kb-extraUpgrade kernel-obs-buildUpgrade dtb-sprdUpgrade kernel-preempt-develUpgrade dtb-allwinnerUpgrade dtb-rockchipUpgrade dlm-kmp-azureUpgrade dtb-armUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-develUpgrade reiserfs-kmp-azureUpgrade dtb-nvidiaUpgrade ocfs2-kmp-rtUpgrade dtb-socionextUpgrade kernel-source-azureUpgrade gfs2-kmp-azureUpgrade dtb-appleUpgrade dlm-kmp-64kbUpgrade kernel-sourceUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-source-rtUpgrade kernel-syms-azureUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade dtb-amlogicUpgrade dtb-renesasUpgrade dtb-caviumUpgrade kernel-debugUpgrade dtb-alteraUpgrade kernel-azure-optionalUpgrade kernel-kvmsmall-vdsoUpgrade dtb-freescaleUpgrade dtb-apmUpgrade kernel-default-extraUpgrade kernel-kvmsmallUpgrade kernel-syms-rtUpgrade kernel-develUpgrade dtb-hisiliconUpgrade kernel-default-manUpgrade reiserfs-kmp-64kbUpgrade dtb-lgUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-obs-qaUpgrade kernel-rt-optionalUpgrade dtb-broadcomUpgrade kernel-64kb-livepatch-develUpgrade kernel-symsUpgrade dtb-amdUpgrade kernel-azure-vdsoUpgrade kernel-64kbUpgrade kernel-azure-baseUpgrade kernel-macrosUpgrade kernel-debug-develUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-zfcpdumpUpgrade kernel-debug-livepatch-develUpgrade dtb-exynosUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-develUpgrade dtb-marvellUpgrade kernel-64kb-develUpgrade dtb-amazonUpgrade kernel-rt_debugUpgrade kernel-docs-htmlUpgrade kernel-default-livepatchUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade gfs2-kmp-rtUpgrade kernel-kvmsmall-devel | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-azureUpgrade linux-bluefieldUpgrade linux-kvmUpgrade linux-ibmUpgrade linux-oracleUpgrade linux-gcpUpgrade linux-raspi-5.4Upgrade linux-fipsUpgrade linux-gcp-fipsUpgrade linux-azure-fipsUpgrade linux-raspiUpgrade linux-azure-5.4Upgrade linux-awsUpgrade linux-hweUpgrade linux-aws-hweUpgrade linux-hwe-5.4Upgrade linuxUpgrade linux-gcp-5.4Upgrade linux-gcp-4.15Upgrade linux-aws-5.4Upgrade linux-azure-4.15Upgrade linux-aws-fipsUpgrade linux-gkeopUpgrade linux-oracle-5.4 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub