In the Linux kernel, the following vulnerability has been resolved:
ovl: fix leaked dentry
Since commit 6815f479ca90 ("ovl: use only uppermetacopy state in ovl_lookup()"), overlayfs doesn't put temporary dentry when there is a metacopy error, which leads to dentry leaks when shutting down the related superblock:
overlayfs: refusing to follow metacopy origin for (/file0) ... BUG: Dentry (____ptrval____){i=3f33,n=file3} still in use (1) [unmount of overlay overlay] ... WARNING: CPU: 1 PID: 432 at umount_check.cold+0x107/0x14d CPU: 1 PID: 432 Comm: unmount-overlay Not tainted 5.12.0-rc5 #1 ... RIP: 0010:umount_check.cold+0x107/0x14d ... Call Trace: d_walk+0x28c/0x950 ? dentry_lru_isolate+0x2b0/0x2b0 ? __kasan_slab_free+0x12/0x20 do_one_tree+0x33/0x60 shrink_dcache_for_umount+0x78/0x1d0 generic_shutdown_super+0x70/0x440 kill_anon_super+0x3e/0x70 deactivate_locked_super+0xc4/0x160 deactivate_super+0xfa/0x140 cleanup_mnt+0x22e/0x370 __cleanup_mnt+0x1a/0x30 task_work_run+0x139/0x210 do_exit+0xb0c/0x2820 ? __kasan_check_read+0x1d/0x30 ? find_held_lock+0x35/0x160 ? lock_release+0x1b6/0x660 ? mm_update_next_owner+0xa20/0xa20 ? reacquire_held_locks+0x3f0/0x3f0 ? __sanitizer_cov_trace_const_cmp4+0x22/0x30 do_group_exit+0x135/0x380 __do_sys_exit_group.isra.0+0x20/0x20 __x64_sys_exit_group+0x3c/0x50 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xae ... VFS: Busy inodes after unmount of overlay. Self-destruct in 5 seconds. Have a nice day...
This fix has been tested with a syzkaller reproducer.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-develUpgrade kernel-cross-headersUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-docUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdumpUpgrade kernelUpgrade kernel-rt-debug-develUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-zfcpdump-coreUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-headersUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernel-rtUpgrade kernel-rt-coreUpgrade kernel-modules-extraUpgrade kernel-coreUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-rt-develUpgrade kernel-rt-debugUpgrade python3-perfUpgrade kernel-zfcpdump-modules-extraUpgrade perfUpgrade kernel-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-modules | Jul 3, 2024 | Feb 27, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade bpftoolUpgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade python-perfUpgrade kernel-headers | May 28, 2024 | Feb 27, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Feb 27, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Feb 27, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 3, 2024 | Feb 27, 2024 |
| Rocky_linux | — | Upgrade kernelUpgrade kernel-cross-headersUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-rt-kvmUpgrade perfUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-develUpgrade kernel-rt-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-debuginfoUpgrade kernel-debug-modules-extraUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-coreUpgrade perf-debuginfoUpgrade kernel-debug-coreUpgrade kernel-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debugUpgrade bpftoolUpgrade kernel-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-libsUpgrade python3-perf-debuginfoUpgrade kernel-rt-debug-kvmUpgrade kernel-modules-extraUpgrade kernel-debug-develUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-core | Jul 16, 2024 | Feb 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub