In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.
ffs_data_clear is indirectly called from both ffs_fs_kill_sb and ffs_ep0_release, so it ends up being called twice when userland closes ep0 and then unmounts f_fs. If userland provided an eventfd along with function's USB descriptors, it ends up calling eventfd_ctx_put as many times, causing a refcount underflow. NULL-ify ffs_eventfd to prevent these extraneous eventfd_ctx_put calls.
Also, set epfiles to NULL right after de-allocating it, for readability.
For completeness, ffs_data_clear actually ends up being called thrice, the last call being before the whole ffs structure gets freed, so when this specific sequence happens there is a second underflow happening (but not being reported):
/sys/kernel/debug/tracing# modprobe usb_f_fs /sys/kernel/debug/tracing# echo ffs_data_clear > set_ftrace_filter /sys/kernel/debug/tracing# echo function > current_tracer /sys/kernel/debug/tracing# echo 1 > tracing_on (setup gadget, run and kill function userland process, teardown gadget) /sys/kernel/debug/tracing# echo 0 > tracing_on /sys/kernel/debug/tracing# cat trace smartcard-openp-436 [000] ..... 1946.208786: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] ..... 1946.279147: ffs_data_clear <-ffs_data_closed smartcard-openp-431 [000] .n... 1946.905512: ffs_data_clear <-ffs_data_put
Warning output corresponding to above trace: [ 1946.284139] WARNING: CPU: 0 PID: 431 at lib/refcount.c:28 refcount_warn_saturate+0x110/0x15c [ 1946.293094] refcount_t: underflow; use-after-free. [ 1946.298164] Modules linked in: usb_f_ncm(E) u_ether(E) usb_f_fs(E) hci_uart(E) btqca(E) btrtl(E) btbcm(E) btintel(E) bluetooth(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) bcm2835_v4l2(CE) bcm2835_mmal_vchiq(CE) videobuf2_vmalloc(E) videobuf2_memops(E) sha512_generic(E) videobuf2_v4l2(E) sha512_arm(E) videobuf2_common(E) videodev(E) cpufreq_dt(E) snd_bcm2835(CE) brcmfmac(E) mc(E) vc4(E) ctr(E) brcmutil(E) snd_soc_core(E) snd_pcm_dmaengine(E) drbg(E) snd_pcm(E) snd_timer(E) snd(E) soundcore(E) drm_kms_helper(E) cec(E) ansi_cprng(E) rc_core(E) syscopyarea(E) raspberrypi_cpufreq(E) sysfillrect(E) sysimgblt(E) cfg80211(E) max17040_battery(OE) raspberrypi_hwmon(E) fb_sys_fops(E) regmap_i2c(E) ecdh_generic(E) rfkill(E) ecc(E) bcm2835_rng(E) rng_core(E) vchiq(CE) leds_gpio(E) libcomposite(E) fuse(E) configfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc16(E) mbcache(E) jbd2(E) crc32c_generic(E) sdhci_iproc(E) sdhci_pltfm(E) sdhci(E) [ 1946.399633] CPU: 0 PID: 431 Comm: smartcard-openp Tainted: G C OE 5.15.0-1-rpi #1 Debian 5.15.3-1 [ 1946.417950] Hardware name: BCM2835 [ 1946.425442] Backtrace: [ 1946.432048] [<c08d60a0>] (dump_backtrace) from [<c08d62ec>] (show_stack+0x20/0x24) [ 1946.448226] r7:00000009 r6:0000001c r5:c04a948c r4:c0a64e2c [ 1946.458412] [<c08d62cc>] (show_stack) from [<c08d9ae0>] (dump_stack+0x28/0x30) [ 1946.470380] [<c08d9ab8>] (dump_stack) from [<c0123500>] (__warn+0xe8/0x154) [ 1946.482067] r5:c04a948c r4:c0a71dc8 [ 1946.490184] [<c0123418>] (__warn) from [<c08d6948>] (warn_slowpath_fmt+0xa0/0xe4) [ 1946.506758] r7:00000009 r6:0000001c r5:c0a71dc8 r4:c0a71e04 [ 1946.517070] [<c08d68ac>] (warn_slowpath_fmt) from [<c04a948c>] (refcount_warn_saturate+0x110/0x15c) [ 1946.535309] r8:c0100224 r7:c0dfcb84 r6:ffffffff r5:c3b84c00 r4:c24a17c0 [ 1946.546708] [<c04a937c>] (refcount_warn_saturate) from [<c0380134>] (eventfd_ctx_put+0x48/0x74) [ 1946.564476] [<c03800ec>] (eventfd_ctx_put) from [<bf5464e8>] (ffs_data_clear+0xd0/0x118 [usb_f_fs]) [ 1946.582664] r5:c3b84c00 r4:c2695b00 [ 1946.590668] [<bf546418>] (ffs_data_clear [usb_f_fs]) from [<bf547cc0>] (ffs_data_closed+0x9c/0x150 [usb_f_fs]) [ 1946.609608] r5:bf54d014 r4:c2695b00 [ 1946.617522] [<bf547c24>] (ffs_data_closed [usb_f_fs]) from [<bf547da0>] (ffs_fs_kill_sb+0x2c/0x30 [usb_f_fs]) [ 1946.636217] r7:c0dfcb ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 27, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 27, 2024 |
| Suse | — | Upgrade kernel-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-buildUpgrade gfs2-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-default-extraUpgrade ocfs2-kmp-64kbUpgrade dtb-amdUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-obs-qaUpgrade dlm-kmp-azureUpgrade kernel-debug-vdsoUpgrade kernel-azure-develUpgrade dtb-broadcomUpgrade kernel-rt-extraUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade kernel-rt_debugUpgrade dtb-freescaleUpgrade kselftests-kmp-azureUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade kernel-syms-rtUpgrade dtb-socionextUpgrade kernel-default-baseUpgrade dtb-apmUpgrade dtb-amlogicUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-azureUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-vdsoUpgrade dtb-amazonUpgrade kernel-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-baseUpgrade ocfs2-kmp-rtUpgrade kernel-source-vanillaUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-develUpgrade kernel-default-livepatchUpgrade kernel-debug-develUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmallUpgrade kernel-default-manUpgrade kernel-rt-optionalUpgrade kernel-default-develUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade kernel-source-rtUpgrade dtb-marvellUpgrade dtb-armUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-optionalUpgrade gfs2-kmp-64kbUpgrade kernel-rt-develUpgrade cluster-md-kmp-azureUpgrade kernel-debugUpgrade ocfs2-kmp-defaultUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-64kbUpgrade dtb-lgUpgrade dtb-renesasUpgrade dtb-caviumUpgrade reiserfs-kmp-defaultUpgrade kernel-preemptUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade cluster-md-kmp-rtUpgrade dtb-mediatekUpgrade kselftests-kmp-64kbUpgrade kernel-default-vdsoUpgrade dtb-hisiliconUpgrade dtb-exynosUpgrade reiserfs-kmp-azureUpgrade kernel-devel-rtUpgrade dlm-kmp-64kbUpgrade dtb-alteraUpgrade kernel-rtUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade kernel-source-azureUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade kernel-devel-azureUpgrade kernel-sourceUpgrade kernel-develUpgrade dtb-xilinxUpgrade kernel-default-base-rebuildUpgrade kernel-default-optionalUpgrade gfs2-kmp-azureUpgrade kernel-symsUpgrade dtb-sprdUpgrade kernel-syms-azureUpgrade kernel-preempt-develUpgrade kernel-64kb-develUpgrade kernel-rt_debug-livepatch-devel | Aug 9, 2024 | Feb 27, 2024 |
| Ubuntu | — | Upgrade linux-image-kvmUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-1135-kvmUpgrade linux-image-virtualUpgrade linux-image-4.4.0-257-genericUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-generic-lts-xenialUpgrade linux-image-awsUpgrade linux-image-4.4.0-1134-awsUpgrade linux-image-4.4.0-1172-awsUpgrade linux-image-lowlatencyUpgrade linux-image-genericUpgrade linux-image-4.4.0-257-lowlatency | Aug 1, 2024 | Feb 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Feb 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub