In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
KASAN reports a use-after-free report when doing fuzz test:
[693354.104835] ================================================================== [693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338
[693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147 [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call Trace: [693354.105621] dump_stack+0xf1/0x19b [693354.105626] ? show_regs_print_info+0x5/0x5 [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumask_weight+0x1f/0x1f [693354.105648] print_address_description+0x70/0x360 [693354.105654] kasan_report+0x1b2/0x330 [693354.105659] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105670] bfq_io_set_weight_legacy+0xd3/0x160 [693354.105675] ? bfq_cpd_init+0x20/0x20 [693354.105683] cgroup_file_write+0x3aa/0x510 [693354.105693] ? ___slab_alloc+0x507/0x540 [693354.105698] ? cgroup_file_poll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopy_abort+0x90/0x90 [693354.105716] ? mutex_lock+0xef/0x180 [693354.105726] kernfs_fop_write+0x1ab/0x280 [693354.105732] ? cgroup_file_poll+0x60/0x60 [693354.105738] vfs_write+0xe7/0x230 [693354.105744] ksys_write+0xb0/0x140 [693354.105749] ? __ia32_sys_read+0x50/0x50 [693354.105760] do_syscall_64+0x112/0x370 [693354.105766] ? syscall_return_slowpath+0x260/0x260 [693354.105772] ? do_page_fault+0x9b/0x270 [693354.105779] ? prepare_exit_to_usermode+0xf9/0x1a0 [693354.105784] ? enter_from_user_mode+0x30/0x30 [693354.105793] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.105875] Allocated by task 1453337: [693354.106001] kasan_kmalloc+0xa0/0xd0 [693354.106006] kmem_cache_alloc_node_trace+0x108/0x220 [693354.106010] bfq_pd_alloc+0x96/0x120 [693354.106015] blkcg_activate_policy+0x1b7/0x2b0 [693354.106020] bfq_create_group_hierarchy+0x1e/0x80 [693354.106026] bfq_init_queue+0x678/0x8c0 [693354.106031] blk_mq_init_sched+0x1f8/0x460 [693354.106037] elevator_switch_mq+0xe1/0x240 [693354.106041] elevator_switch+0x25/0x40 [693354.106045] elv_iosched_store+0x1a1/0x230 [693354.106049] queue_attr_store+0x78/0xb0 [693354.106053] kernfs_fop_write+0x1ab/0x280 [693354.106056] vfs_write+0xe7/0x230 [693354.106060] ksys_write+0xb0/0x140 [693354.106064] do_syscall_64+0x112/0x370 [693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.106114] Freed by task 1453336: [693354.106225] __kasan_slab_free+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233] blkcg_deactivate_policy+0x12c/0x220 [693354.106238] bfq_exit_queue+0xf5/0x110 [693354.106241] blk_mq_exit_sched+0x104/0x130 [693354.106245] __elevator_exit+0x45/0x60 [693354.106249] elevator_switch_mq+0xd6/0x240 [693354.106253] elevator_switch+0x25/0x40 [693354.106257] elv_iosched_store+0x1a1/0x230 [693354.106261] queue_attr_store+0x78/0xb0 [693354.106264] kernfs_fop_write+0x1ab/0x280 [693354.106268] vfs_write+0xe7/0x230 [693354.106271] ksys_write+0xb0/0x140 [693354.106275] do_syscall_64+0x112/0x370 [693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page: [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] r ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade perfUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade kernelUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-livepatch-5.10.75-79.358Upgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-tools-debuginfo | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-64kb-optionalUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade dlm-kmp-64kbUpgrade kernel-macrosUpgrade kernel-preemptUpgrade kernel-devel-rtUpgrade kernel-azure-extraUpgrade kselftests-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-default-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-extraUpgrade kernel-kvmsmallUpgrade dtb-armUpgrade kernel-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-syms-azureUpgrade kselftests-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-obs-qaUpgrade kernel-rt-livepatchUpgrade kernel-sourceUpgrade kernel-debug-develUpgrade kernel-debugUpgrade dtb-lgUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-syms-rtUpgrade kernel-default-optionalUpgrade dtb-amazonUpgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade dtb-hisiliconUpgrade dtb-appleUpgrade kernel-symsUpgrade kernel-source-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-azureUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade dtb-freescaleUpgrade kernel-azure-livepatch-develUpgrade dtb-amlogicUpgrade cluster-md-kmp-azureUpgrade dtb-amdUpgrade dtb-xilinxUpgrade kernel-default-manUpgrade dtb-apmUpgrade kernel-64kb-develUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-docs-htmlUpgrade kernel-rtUpgrade kernel-rt-optionalUpgrade dlm-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade dtb-broadcomUpgrade gfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade dtb-qcomUpgrade kernel-default-vdsoUpgrade kernel-rt-extraUpgrade kernel-default-livepatch-develUpgrade dtb-sprdUpgrade kernel-azure-baseUpgrade kernel-preempt-develUpgrade kernel-debug-vdsoUpgrade kernel-docsUpgrade kernel-azure-optionalUpgrade kernel-azure-develUpgrade dlm-kmp-defaultUpgrade dtb-renesasUpgrade reiserfs-kmp-rtUpgrade dtb-caviumUpgrade kernel-azureUpgrade kernel-defaultUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-alteraUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade dtb-rockchipUpgrade reiserfs-kmp-64kbUpgrade kernel-default-baseUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade dtb-marvellUpgrade kselftests-kmp-azureUpgrade kernel-rt_debugUpgrade kernel-source-rtUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-rt | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-oracleUpgrade linux-image-4.15.0-239-genericUpgrade linux-image-4.15.0-1190-azureUpgrade linux-image-gkeUpgrade linux-image-oracle-4.15Upgrade linux-image-oemUpgrade linux-image-4.15.0-1182-awsUpgrade linux-image-aws-lts-18.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.15.0-2099-azure-fipsUpgrade linux-image-4.15.0-1165-kvmUpgrade linux-image-4.15.0-2120-aws-fipsUpgrade linux-image-gcpUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-azure-4.15Upgrade linux-image-4.15.0-1144-oracleUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-aws-fips-4.15Upgrade linux-image-4.15.0-2083-gcp-fipsUpgrade linux-image-4.15.0-239-lowlatencyUpgrade linux-image-4.15.0-1137-fipsUpgrade linux-image-fipsUpgrade linux-image-gcp-4.15Upgrade linux-image-azure-fipsUpgrade linux-image-genericUpgrade linux-image-gcp-fips-4.15Upgrade linux-image-4.15.0-1175-gcpUpgrade linux-image-aws-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-azure-lts-18.04Upgrade linux-image-aws-4.15Upgrade linux-image-gcp-fipsUpgrade linux-image-azureUpgrade linux-image-aws-hwe | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub