In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
There is an use-after-free problem triggered by following process:
P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset <- nullptr deference (use-after-free) !!! rcu_read_unlock
[ 502.714379] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 502.715260] #PF: supervisor read access in kernel mode [ 502.715903] #PF: error_code(0x0000) - not-present page [ 502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Oops: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Call Trace: [ 502.733193] __blk_add_trace.cold+0x137/0x1a3 [ 502.733734] blk_add_trace_rq+0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.742704] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100
Reproduce method: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb, BLKTRACESTART)
echo 0 > /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free()
ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out)
Remove blk_trace from running_list before calling blk_trace_free() by sysfs if blk_trace is at Blktrace_running state.
CVSS Details
- CVSS 3.1 Base Score: 6.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfoUpgrade python-perfUpgrade kernel-livepatch-4.14.252-195.481Upgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-5.10.75-79.358Upgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64 | Mar 14, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-rt-livepatchUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade cluster-md-kmp-rtUpgrade kernel-preemptUpgrade kernel-rtUpgrade dtb-sprdUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-azureUpgrade kernel-azureUpgrade dtb-rockchipUpgrade kernel-default-baseUpgrade kernel-source-vanillaUpgrade dtb-allwinnerUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-preempt-develUpgrade dtb-qcomUpgrade dtb-xilinxUpgrade ocfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-devel-rtUpgrade kernel-rt-vdsoUpgrade kernel-azure-develUpgrade gfs2-kmp-defaultUpgrade kernel-debug-vdsoUpgrade dlm-kmp-defaultUpgrade dtb-armUpgrade kernel-default-base-rebuildUpgrade kernel-docsUpgrade kernel-64kb-extraUpgrade dtb-mediatekUpgrade kernel-rt-develUpgrade kernel-default-optionalUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-obs-buildUpgrade kselftests-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-debugUpgrade kselftests-kmp-azureUpgrade kernel-rt-optionalUpgrade kselftests-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-syms-rtUpgrade kernel-default-manUpgrade cluster-md-kmp-azureUpgrade kernel-source-rtUpgrade kernel-debug-livepatch-develUpgrade dtb-lgUpgrade kernel-develUpgrade dtb-hisiliconUpgrade kernel-64kb-develUpgrade kernel-syms-azureUpgrade dtb-renesasUpgrade dtb-socionextUpgrade kernel-zfcpdumpUpgrade kernel-default-livepatchUpgrade dtb-amlogicUpgrade kernel-azure-optionalUpgrade ocfs2-kmp-azureUpgrade dtb-caviumUpgrade reiserfs-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade kernel-sourceUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade dtb-appleUpgrade kernel-debug-develUpgrade kernel-rt_debugUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade dtb-marvellUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-obs-qaUpgrade gfs2-kmp-azureUpgrade dtb-freescaleUpgrade kernel-kvmsmall-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade dtb-alteraUpgrade kernel-rt-livepatch-develUpgrade kernel-default-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-rt_debug-develUpgrade reiserfs-kmp-rtUpgrade dtb-amazonUpgrade dtb-apmUpgrade dtb-amdUpgrade kernel-64kb-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-macrosUpgrade dtb-exynosUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade kernel-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-baseUpgrade kernel-azure-vdso | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-oracleUpgrade linux-ibmUpgrade linux-raspi-5.4Upgrade linux-gcp-fipsUpgrade linux-azureUpgrade linux-bluefieldUpgrade linux-fipsUpgrade linux-kvmUpgrade linux-gcpUpgrade linuxUpgrade linux-hwe-5.4Upgrade linux-gkeopUpgrade linux-aws-hweUpgrade linux-azure-fipsUpgrade linux-oracle-5.4Upgrade linux-hweUpgrade linux-aws-fipsUpgrade linux-awsUpgrade linux-gcp-5.4Upgrade linux-aws-5.4Upgrade linux-azure-4.15Upgrade linux-azure-5.4Upgrade linux-raspiUpgrade linux-gcp-4.15 | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub