In the Linux kernel, the following vulnerability has been resolved:
ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module
Hi,
When testing install and uninstall of ipmi_si.ko and ipmi_msghandler.ko, the system crashed.
The log as follows: [ 141.087026] BUG: unable to handle kernel paging request at ffffffffc09b3a5a [ 141.087241] PGD 8fe4c0d067 P4D 8fe4c0d067 PUD 8fe4c0f067 PMD 103ad89067 PTE 0 [ 141.087464] Oops: 0010 [#1] SMP NOPTI [ 141.087580] CPU: 67 PID: 668 Comm: kworker/67:1 Kdump: loaded Not tainted 4.18.0.x86_64 #47 [ 141.088009] Workqueue: events 0xffffffffc09b3a40 [ 141.088009] RIP: 0010:0xffffffffc09b3a5a [ 141.088009] Code: Bad RIP value. [ 141.088009] RSP: 0018:ffffb9094e2c3e88 EFLAGS: 00010246 [ 141.088009] RAX: 0000000000000000 RBX: ffff9abfdb1f04a0 RCX: 0000000000000000 [ 141.088009] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 141.088009] RBP: 0000000000000000 R08: ffff9abfffee3cb8 R09: 00000000000002e1 [ 141.088009] R10: ffffb9094cb73d90 R11: 00000000000f4240 R12: ffff9abfffee8700 [ 141.088009] R13: 0000000000000000 R14: ffff9abfdb1f04a0 R15: ffff9abfdb1f04a8 [ 141.088009] FS: 0000000000000000(0000) GS:ffff9abfffec0000(0000) knlGS:0000000000000000 [ 141.088009] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 141.088009] CR2: ffffffffc09b3a30 CR3: 0000008fe4c0a001 CR4: 00000000007606e0 [ 141.088009] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 141.088009] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 141.088009] PKRU: 55555554 [ 141.088009] Call Trace: [ 141.088009] ? process_one_work+0x195/0x390 [ 141.088009] ? worker_thread+0x30/0x390 [ 141.088009] ? process_one_work+0x390/0x390 [ 141.088009] ? kthread+0x10d/0x130 [ 141.088009] ? kthread_flush_work_fn+0x10/0x10 [ 141.088009] ? ret_from_fork+0x35/0x40] BUG: unable to handle kernel paging request at ffffffffc0b28a5a [ 200.223240] PGD 97fe00d067 P4D 97fe00d067 PUD 97fe00f067 PMD a580cbf067 PTE 0 [ 200.223464] Oops: 0010 [#1] SMP NOPTI [ 200.223579] CPU: 63 PID: 664 Comm: kworker/63:1 Kdump: loaded Not tainted 4.18.0.x86_64 #46 [ 200.224008] Workqueue: events 0xffffffffc0b28a40 [ 200.224008] RIP: 0010:0xffffffffc0b28a5a [ 200.224008] Code: Bad RIP value. [ 200.224008] RSP: 0018:ffffbf3c8e2a3e88 EFLAGS: 00010246 [ 200.224008] RAX: 0000000000000000 RBX: ffffa0799ad6bca0 RCX: 0000000000000000 [ 200.224008] RDX: 0000000000000000 RSI: 0000000000000246 RDI: 0000000000000246 [ 200.224008] RBP: 0000000000000000 R08: ffff9fe43fde3cb8 R09: 00000000000000d5 [ 200.224008] R10: ffffbf3c8cb53d90 R11: 00000000000f4240 R12: ffff9fe43fde8700 [ 200.224008] R13: 0000000000000000 R14: ffffa0799ad6bca0 R15: ffffa0799ad6bca8 [ 200.224008] FS: 0000000000000000(0000) GS:ffff9fe43fdc0000(0000) knlGS:0000000000000000 [ 200.224008] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.224008] CR2: ffffffffc0b28a30 CR3: 00000097fe00a002 CR4: 00000000007606e0 [ 200.224008] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 200.224008] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 200.224008] PKRU: 55555554 [ 200.224008] Call Trace: [ 200.224008] ? process_one_work+0x195/0x390 [ 200.224008] ? worker_thread+0x30/0x390 [ 200.224008] ? process_one_work+0x390/0x390 [ 200.224008] ? kthread+0x10d/0x130 [ 200.224008] ? kthread_flush_work_fn+0x10/0x10 [ 200.224008] ? ret_from_fork+0x35/0x40 [ 200.224008] kernel fault(0x1) notification starting on CPU 63 [ 200.224008] kernel fault(0x1) notification finished on CPU 63 [ 200.224008] CR2: ffffffffc0b28a5a [ 200.224008] ---[ end trace c82a412d93f57412 ]---
The reason is as follows: T1: rmmod ipmi_si. ->ipmi_unregister_smi() -> ipmi_bmc_unregister() -> __ipmi_bmc_unregister() -> kref_put(&bmc->usecount, cleanup_bmc_device); -> schedule_work(&bmc->remove_work);
T2: rmmod ipmi_msghandl ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 4, 2024 |
| Suse | — | Upgrade dtb-alteraUpgrade dtb-allwinnerUpgrade kernel-default-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debugUpgrade dtb-nvidiaUpgrade dtb-hisiliconUpgrade gfs2-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade kernel-preemptUpgrade ocfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade kernel-preempt-develUpgrade kernel-sourceUpgrade dtb-qcomUpgrade kernel-64kb-extraUpgrade ocfs2-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-symsUpgrade ocfs2-kmp-rtUpgrade dtb-armUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-develUpgrade kernel-64kb-optionalUpgrade kernel-zfcpdumpUpgrade dtb-rockchipUpgrade kernel-debug-develUpgrade dtb-exynosUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-64kbUpgrade kernel-develUpgrade dtb-apmUpgrade dtb-caviumUpgrade kernel-defaultUpgrade kernel-default-vdsoUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-develUpgrade cluster-md-kmp-rtUpgrade dtb-mediatekUpgrade gfs2-kmp-azureUpgrade kernel-devel-rtUpgrade dtb-xilinxUpgrade dtb-renesasUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-obs-qaUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-default-manUpgrade kernel-kvmsmall-vdsoUpgrade dtb-freescaleUpgrade dtb-amlogicUpgrade kernel-source-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-syms-azureUpgrade dtb-lgUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-devel-azureUpgrade kernel-debug-vdsoUpgrade kernel-rtUpgrade kernel-syms-rtUpgrade kernel-rt_debug-develUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-default-baseUpgrade kernel-azure-vdsoUpgrade kernel-rt_debugUpgrade reiserfs-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-rt-extraUpgrade kernel-azure-livepatch-develUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade kernel-macrosUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade kernel-docs-htmlUpgrade kernel-azure-extraUpgrade kernel-64kbUpgrade dtb-appleUpgrade kernel-source-vanillaUpgrade dlm-kmp-azureUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade kernel-azureUpgrade dtb-amazonUpgrade dtb-socionextUpgrade kernel-rt-livepatch-develUpgrade kernel-docsUpgrade kernel-obs-buildUpgrade kernel-default-develUpgrade gfs2-kmp-rtUpgrade dtb-amdUpgrade kernel-azure-baseUpgrade dtb-broadcomUpgrade kernel-rt_debug-vdsoUpgrade dtb-sprd | Aug 9, 2024 | Mar 4, 2024 |
| Ubuntu | — | Upgrade linux-gcpUpgrade linux-ibm-5.4Upgrade linux-oracle-5.4Upgrade linux-gcp-5.4Upgrade linux-raspi-5.4Upgrade linux-aws-5.4Upgrade linuxUpgrade linux-fipsUpgrade linux-bluefieldUpgrade linux-gcp-fipsUpgrade linux-oracleUpgrade linux-awsUpgrade linux-azure-fipsUpgrade linux-hwe-5.4Upgrade linux-azureUpgrade linux-azure-5.4Upgrade linux-aws-fipsUpgrade linux-kvmUpgrade linux-raspiUpgrade linux-ibmUpgrade linux-gkeop | Nov 19, 2024 | Mar 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub