In the Linux kernel, the following vulnerability has been resolved:
blktrace: Fix uaf in blk_trace access after removing by sysfs
There is an use-after-free problem triggered by following process:
P1(sda) P2(sdb) echo 0 > /sys/block/sdb/trace/enable blk_trace_remove_queue synchronize_rcu blk_trace_free relay_close rcu_read_lock __blk_add_trace trace_note_tsk (Iterate running_trace_list) relay_close_buf relay_destroy_buf kfree(buf) trace_note(sdb's bt) relay_reserve buf->offset <- nullptr deference (use-after-free) !!! rcu_read_unlock
[ 502.714379] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 502.715260] #PF: supervisor read access in kernel mode [ 502.715903] #PF: error_code(0x0000) - not-present page [ 502.716546] PGD 103984067 P4D 103984067 PUD 17592b067 PMD 0 [ 502.717252] Oops: 0000 [#1] SMP [ 502.720308] RIP: 0010:trace_note.isra.0+0x86/0x360 [ 502.732872] Call Trace: [ 502.733193] __blk_add_trace.cold+0x137/0x1a3 [ 502.733734] blk_add_trace_rq+0x7b/0xd0 [ 502.734207] blk_add_trace_rq_issue+0x54/0xa0 [ 502.734755] blk_mq_start_request+0xde/0x1b0 [ 502.735287] scsi_queue_rq+0x528/0x1140 ... [ 502.742704] sg_new_write.isra.0+0x16e/0x3e0 [ 502.747501] sg_ioctl+0x466/0x1100
Reproduce method: ioctl(/dev/sda, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sda, BLKTRACESTART) ioctl(/dev/sdb, BLKTRACESETUP, blk_user_trace_setup[buf_size=127]) ioctl(/dev/sdb, BLKTRACESTART)
echo 0 > /sys/block/sdb/trace/enable & // Add delay(mdelay/msleep) before kernel enters blk_trace_free()
ioctl$SG_IO(/dev/sda, SG_IO, ...) // Enters trace_note_tsk() after blk_trace_free() returned // Use mdelay in rcu region rather than msleep(which may schedule out)
Remove blk_trace from running_list before calling blk_trace_free() by sysfs if blk_trace is at Blktrace_running state.
CVSS Details
- CVSS 3.1 Base Score: 6.2
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfoUpgrade kernel-livepatch-4.14.252-195.481Upgrade python-perfUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel-livepatch-5.10.75-79.358Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel | Mar 14, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-defaultUpgrade kernel-default-optionalUpgrade dtb-mediatekUpgrade kernel-default-baseUpgrade kselftests-kmp-defaultUpgrade kernel-obs-buildUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-docsUpgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-azure-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-rt-develUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-default-vdsoUpgrade dlm-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-rt_debug-vdsoUpgrade dtb-armUpgrade kernel-debug-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-rt-extraUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-azureUpgrade dtb-sprdUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade kernel-azureUpgrade kernel-rtUpgrade kernel-preemptUpgrade kernel-devel-rtUpgrade kernel-preempt-develUpgrade dtb-qcomUpgrade kselftests-kmp-rtUpgrade dtb-renesasUpgrade kernel-rt-optionalUpgrade kernel-default-livepatchUpgrade dtb-amazonUpgrade ocfs2-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-optionalUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade kernel-zfcpdumpUpgrade kernel-debug-develUpgrade gfs2-kmp-rtUpgrade kernel-default-manUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-rt_debugUpgrade kernel-64kb-develUpgrade kernel-default-develUpgrade dtb-marvellUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade dtb-freescaleUpgrade dtb-caviumUpgrade dtb-alteraUpgrade reiserfs-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade dtb-appleUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-devel-azureUpgrade dtb-apmUpgrade reiserfs-kmp-rtUpgrade kernel-sourceUpgrade kernel-debug-livepatch-develUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-baseUpgrade gfs2-kmp-azureUpgrade dtb-socionextUpgrade kernel-debugUpgrade dtb-amlogicUpgrade dtb-amdUpgrade kernel-64kbUpgrade dtb-broadcomUpgrade kernel-64kb-livepatch-develUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade kernel-develUpgrade kselftests-kmp-64kbUpgrade dtb-exynosUpgrade kernel-source-rtUpgrade kernel-azure-vdsoUpgrade dtb-hisiliconUpgrade kernel-obs-qaUpgrade kernel-default-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade kernel-macrosUpgrade kernel-rt_debug-develUpgrade kernel-64kb-optionalUpgrade kselftests-kmp-azure | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-gcp-fipsUpgrade linux-fipsUpgrade linux-kvmUpgrade linux-gcpUpgrade linux-azureUpgrade linux-ibmUpgrade linux-oracleUpgrade linux-bluefieldUpgrade linux-raspi-5.4Upgrade linux-oracle-5.4Upgrade linux-azure-4.15Upgrade linux-gkeopUpgrade linux-hweUpgrade linux-aws-hweUpgrade linux-hwe-5.4Upgrade linux-gcp-5.4Upgrade linux-aws-5.4Upgrade linux-azure-fipsUpgrade linuxUpgrade linux-gcp-4.15Upgrade linux-raspiUpgrade linux-awsUpgrade linux-azure-5.4Upgrade linux-aws-fips | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub