In the Linux kernel, the following vulnerability has been resolved:
drbd: Fix five use after free bugs in get_initial_state
In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug.
What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened.
My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid.
v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.112-108.499Upgrade kernelUpgrade kernel-develUpgrade kernel-livepatch-4.14.276-211.499Upgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade python-perf-debuginfo | Apr 10, 2025 | Feb 26, 2025 |
| Amazon_linux | — | Upgrade kernel | Apr 10, 2025 | Jun 9, 2022 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-oracleUpgrade linux-bluefieldUpgrade linux-azure-5.15Upgrade linux-raspi-5.4Upgrade linux-intel-iotgUpgrade linux-hweUpgrade linux-iotUpgrade linux-realtimeUpgrade linux-fipsUpgrade linux-azureUpgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-azure-4.15Upgrade linux-intel-iotg-5.15Upgrade linux-raspiUpgrade linux-azure-5.4Upgrade linux-hwe-5.15Upgrade linux-ibmUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-4.15Upgrade linux-gcpUpgrade linux-aws-fipsUpgrade linux-gkeUpgrade linux-gcp-5.4Upgrade linux-ibm-5.4Upgrade linux-hwe-5.4Upgrade linux-azure-fipsUpgrade linux-lowlatencyUpgrade linux-awsUpgrade linux-oracle-5.4Upgrade linux-gcp-fipsUpgrade linuxUpgrade linux-aws-hwe | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub