In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page.
NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly.
[[email protected]: NOTE added to the commit log]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-4.14.327-246.539Upgrade kernel-headersUpgrade kernel-livepatch-5.10.198-187.748Upgrade kernel-tools-debuginfoUpgrade kernel-tools-devel | Aug 2, 2024 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade dtb-hisiliconUpgrade dtb-allwinnerUpgrade kernel-64kb-develUpgrade dlm-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-defaultUpgrade kernel-source-rtUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade dtb-socionextUpgrade dtb-sprdUpgrade dtb-marvellUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-docsUpgrade dtb-armUpgrade kernel-64kb-optionalUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debugUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-azure-vdsoUpgrade kernel-debug-develUpgrade reiserfs-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-vdsoUpgrade dtb-appleUpgrade kselftests-kmp-rtUpgrade kernel-docs-htmlUpgrade dlm-kmp-azureUpgrade kernel-azure-extraUpgrade kernel-default-baseUpgrade kernel-rt-extraUpgrade kernel-debugUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-rt-optionalUpgrade dtb-renesasUpgrade kernel-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-nvidiaUpgrade kernel-syms-rtUpgrade kernel-azure-optionalUpgrade kernel-rt-develUpgrade dtb-rockchipUpgrade kselftests-kmp-azureUpgrade dtb-lgUpgrade kernel-azure-develUpgrade dtb-freescaleUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-64kb-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-develUpgrade dtb-exynosUpgrade kernel-default-livepatchUpgrade dtb-amazonUpgrade kernel-source-azureUpgrade dtb-qcomUpgrade kernel-rt-livepatchUpgrade kernel-devel-azureUpgrade kernel-devel-rtUpgrade kernel-sourceUpgrade kernel-macrosUpgrade dtb-apmUpgrade dtb-amlogicUpgrade dlm-kmp-64kbUpgrade kernel-rtUpgrade dtb-caviumUpgrade kernel-obs-qaUpgrade kernel-kvmsmall-develUpgrade kernel-default-vdsoUpgrade kernel-symsUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade kernel-default-optionalUpgrade kernel-default-develUpgrade kernel-default-base-rebuildUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade dtb-mediatekUpgrade dtb-alteraUpgrade cluster-md-kmp-rtUpgrade kernel-devel | Apr 17, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-image-4.4.0-1131-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-aws-lts-18.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-azure-lts-18.04Upgrade linux-image-oemUpgrade linux-image-virtualUpgrade linux-image-oracleUpgrade linux-image-4.15.0-225-genericUpgrade linux-image-genericUpgrade linux-image-4.4.0-1169-awsUpgrade linux-image-4.15.0-225-lowlatencyUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-gkeUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.15.0-1162-gcpUpgrade linux-image-4.4.0-254-genericUpgrade linux-image-4.15.0-1177-azureUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.15.0-1152-kvmUpgrade linux-image-aws-hweUpgrade linux-image-4.4.0-254-lowlatencyUpgrade linux-image-azureUpgrade linux-image-4.15.0-1131-oracleUpgrade linux-image-awsUpgrade linux-image-4.4.0-1132-kvmUpgrade linux-image-4.15.0-1168-awsUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-kvmUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-lowlatencyUpgrade linux-image-gcp | May 20, 2024 | Mar 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub