In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.
Also, set epfiles to NULL right after de-allocating it, for readability.
For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported):
/sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put
Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 27, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2024 |
| Suse | — | Upgrade reiserfs-kmp-rtUpgrade dlm-kmp-azureUpgrade dtb-broadcomUpgrade cluster-md-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-obs-buildUpgrade kernel-obs-qaUpgrade kernel-debug-vdsoUpgrade kernel-azure-develUpgrade dtb-freescaleUpgrade dtb-amlogicUpgrade dtb-apmUpgrade kernel-64kb-optionalUpgrade dtb-amazonUpgrade kselftests-kmp-defaultUpgrade dtb-appleUpgrade kernel-rt-optionalUpgrade kernel-azure-extraUpgrade kernel-rt_debug-develUpgrade kernel-defaultUpgrade kernel-syms-rtUpgrade kernel-rt_debugUpgrade dtb-socionextUpgrade kernel-kvmsmall-develUpgrade kernel-source-rtUpgrade kernel-default-livepatchUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-default-manUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-default-baseUpgrade kernel-azureUpgrade dlm-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade kernel-default-extraUpgrade kernel-docsUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-rtUpgrade dlm-kmp-rtUpgrade gfs2-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-macrosUpgrade kernel-kvmsmallUpgrade dtb-marvellUpgrade reiserfs-kmp-64kbUpgrade kernel-64kbUpgrade kernel-azure-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-azure-vdsoUpgrade kernel-azure-baseUpgrade kernel-default-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-develUpgrade kernel-rt-extraUpgrade kernel-default-livepatch-develUpgrade dtb-amdUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade dtb-hisiliconUpgrade gfs2-kmp-azureUpgrade kernel-preempt-develUpgrade dtb-caviumUpgrade kernel-sourceUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-defaultUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade dtb-armUpgrade kernel-rtUpgrade kernel-rt-develUpgrade kernel-rt-livepatchUpgrade kernel-devel-rtUpgrade kselftests-kmp-64kbUpgrade kernel-devel-azureUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-develUpgrade dtb-renesasUpgrade dtb-xilinxUpgrade kernel-preemptUpgrade kernel-develUpgrade dtb-qcomUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debugUpgrade kernel-syms-azureUpgrade gfs2-kmp-defaultUpgrade dtb-sprdUpgrade kernel-source-azureUpgrade kernel-symsUpgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade dtb-nvidiaUpgrade kernel-64kb-livepatch-develUpgrade dtb-alteraUpgrade dtb-lgUpgrade kernel-64kb-extraUpgrade dtb-mediatekUpgrade dtb-exynos | Aug 9, 2024 | Feb 27, 2024 |
| Ubuntu | — | Upgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-4.4.0-257-lowlatencyUpgrade linux-image-4.4.0-1172-awsUpgrade linux-image-4.4.0-1134-awsUpgrade linux-image-4.4.0-1135-kvmUpgrade linux-image-generic-lts-xenialUpgrade linux-image-virtualUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.4.0-257-generic | Aug 1, 2024 | Feb 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub