In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.
Also, set epfiles to NULL right after de-allocating it, for readability.
For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported):
/sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put
Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 27, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2024 |
| Suse | — | Upgrade kernel-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-rt_debugUpgrade kernel-debug-vdsoUpgrade kernel-obs-qaUpgrade dtb-freescaleUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-vdsoUpgrade dtb-socionextUpgrade kernel-default-develUpgrade kernel-azure-baseUpgrade kernel-default-livepatch-develUpgrade kernel-rt-optionalUpgrade dtb-amlogicUpgrade dtb-marvellUpgrade kernel-syms-rtUpgrade kernel-defaultUpgrade kernel-azure-extraUpgrade dtb-amazonUpgrade ocfs2-kmp-rtUpgrade dtb-broadcomUpgrade dlm-kmp-azureUpgrade kernel-source-vanillaUpgrade dtb-apmUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-develUpgrade kernel-default-manUpgrade kernel-source-rtUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmallUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-obs-buildUpgrade reiserfs-kmp-rtUpgrade kernel-macrosUpgrade gfs2-kmp-rtUpgrade dtb-amdUpgrade kernel-64kb-optionalUpgrade dtb-appleUpgrade kernel-azure-livepatch-develUpgrade kernel-debug-develUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-azure-develUpgrade ocfs2-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-rt-livepatch-develUpgrade kernel-debug-livepatch-develUpgrade kernel-default-baseUpgrade reiserfs-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-64kbUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-kvmsmall-develUpgrade kernel-docsUpgrade dlm-kmp-rtUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-caviumUpgrade kernel-source-azureUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade dtb-renesasUpgrade kernel-debugUpgrade dtb-qcomUpgrade kernel-64kb-develUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-rt-develUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade cluster-md-kmp-64kbUpgrade dtb-armUpgrade kernel-syms-azureUpgrade dlm-kmp-64kbUpgrade kernel-symsUpgrade dtb-sprdUpgrade dtb-alteraUpgrade gfs2-kmp-azureUpgrade kernel-default-vdsoUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-preempt-develUpgrade dtb-exynosUpgrade kernel-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-mediatekUpgrade dtb-nvidiaUpgrade dtb-allwinnerUpgrade kernel-default-optionalUpgrade dtb-rockchipUpgrade dtb-lgUpgrade kernel-64kb-extraUpgrade kernel-develUpgrade kernel-sourceUpgrade kernel-preemptUpgrade kselftests-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade dtb-xilinxUpgrade kernel-devel-azure | Aug 9, 2024 | Feb 27, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-1134-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-257-genericUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1135-kvmUpgrade linux-image-virtualUpgrade linux-image-awsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-1172-awsUpgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-257-lowlatency | Aug 1, 2024 | Feb 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub