In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.
Also, set epfiles to NULL right after de-allocating it, for readability.
For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported):
/sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put
Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 27, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2024 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-default-manUpgrade dtb-appleUpgrade kernel-default-livepatchUpgrade dtb-amazonUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-develUpgrade dtb-broadcomUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade kernel-azure-develUpgrade dlm-kmp-defaultUpgrade dtb-freescaleUpgrade kernel-docsUpgrade kernel-debug-develUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-azure-baseUpgrade kernel-docs-htmlUpgrade dtb-marvellUpgrade dtb-amdUpgrade gfs2-kmp-rtUpgrade kernel-64kbUpgrade kernel-default-develUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-rt_debugUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmallUpgrade dlm-kmp-rtUpgrade kernel-default-baseUpgrade kernel-macrosUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-source-vanillaUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-rt-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-azureUpgrade kernel-source-rtUpgrade dtb-apmUpgrade reiserfs-kmp-rtUpgrade dtb-socionextUpgrade dtb-amlogicUpgrade kernel-syms-rtUpgrade kernel-64kb-extraUpgrade gfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-preemptUpgrade cluster-md-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-source-azureUpgrade kernel-rtUpgrade dtb-nvidiaUpgrade dtb-lgUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade dtb-armUpgrade kernel-default-vdsoUpgrade kernel-devel-rtUpgrade dtb-caviumUpgrade dtb-qcomUpgrade dtb-alteraUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-symsUpgrade kernel-preempt-develUpgrade kernel-syms-azureUpgrade dlm-kmp-64kbUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade dtb-hisiliconUpgrade kernel-64kb-livepatch-develUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-develUpgrade gfs2-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-azureUpgrade dtb-renesasUpgrade cluster-md-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade dtb-xilinxUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-sourceUpgrade kernel-develUpgrade kernel-devel-azure | Aug 9, 2024 | Feb 27, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-1135-kvmUpgrade linux-image-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1134-awsUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-257-genericUpgrade linux-image-4.4.0-1172-awsUpgrade linux-image-virtualUpgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-257-lowlatency | Aug 1, 2024 | Feb 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub