In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
KASAN reports a use-after-free report when doing fuzz test:
[693354.104835] ================================================================== [693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338
[693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147 [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call Trace: [693354.105621] dump_stack+0xf1/0x19b [693354.105626] ? show_regs_print_info+0x5/0x5 [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumask_weight+0x1f/0x1f [693354.105648] print_address_description+0x70/0x360 [693354.105654] kasan_report+0x1b2/0x330 [693354.105659] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105670] bfq_io_set_weight_legacy+0xd3/0x160 [693354.105675] ? bfq_cpd_init+0x20/0x20 [693354.105683] cgroup_file_write+0x3aa/0x510 [693354.105693] ? ___slab_alloc+0x507/0x540 [693354.105698] ? cgroup_file_poll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopy_abort+0x90/0x90 [693354.105716] ? mutex_lock+0xef/0x180 [693354.105726] kernfs_fop_write+0x1ab/0x280 [693354.105732] ? cgroup_file_poll+0x60/0x60 [693354.105738] vfs_write+0xe7/0x230 [693354.105744] ksys_write+0xb0/0x140 [693354.105749] ? __ia32_sys_read+0x50/0x50 [693354.105760] do_syscall_64+0x112/0x370 [693354.105766] ? syscall_return_slowpath+0x260/0x260 [693354.105772] ? do_page_fault+0x9b/0x270 [693354.105779] ? prepare_exit_to_usermode+0xf9/0x1a0 [693354.105784] ? enter_from_user_mode+0x30/0x30 [693354.105793] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.105875] Allocated by task 1453337: [693354.106001] kasan_kmalloc+0xa0/0xd0 [693354.106006] kmem_cache_alloc_node_trace+0x108/0x220 [693354.106010] bfq_pd_alloc+0x96/0x120 [693354.106015] blkcg_activate_policy+0x1b7/0x2b0 [693354.106020] bfq_create_group_hierarchy+0x1e/0x80 [693354.106026] bfq_init_queue+0x678/0x8c0 [693354.106031] blk_mq_init_sched+0x1f8/0x460 [693354.106037] elevator_switch_mq+0xe1/0x240 [693354.106041] elevator_switch+0x25/0x40 [693354.106045] elv_iosched_store+0x1a1/0x230 [693354.106049] queue_attr_store+0x78/0xb0 [693354.106053] kernfs_fop_write+0x1ab/0x280 [693354.106056] vfs_write+0xe7/0x230 [693354.106060] ksys_write+0xb0/0x140 [693354.106064] do_syscall_64+0x112/0x370 [693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.106114] Freed by task 1453336: [693354.106225] __kasan_slab_free+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233] blkcg_deactivate_policy+0x12c/0x220 [693354.106238] bfq_exit_queue+0xf5/0x110 [693354.106241] blk_mq_exit_sched+0x104/0x130 [693354.106245] __elevator_exit+0x45/0x60 [693354.106249] elevator_switch_mq+0xd6/0x240 [693354.106253] elevator_switch+0x25/0x40 [693354.106257] elv_iosched_store+0x1a1/0x230 [693354.106261] queue_attr_store+0x78/0xb0 [693354.106264] kernfs_fop_write+0x1ab/0x280 [693354.106268] vfs_write+0xe7/0x230 [693354.106271] ksys_write+0xb0/0x140 [693354.106275] do_syscall_64+0x112/0x370 [693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page: [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] r ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade perfUpgrade kernel-debuginfo-common-x86_64Upgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade python-perf-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-livepatch-5.10.75-79.358Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade bpftool | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade cluster-md-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-azure-extraUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-devel-rtUpgrade kernel-preemptUpgrade kernel-rt-develUpgrade kernel-macrosUpgrade dlm-kmp-64kbUpgrade kernel-default-extraUpgrade kernel-default-develUpgrade dtb-freescaleUpgrade kernel-azure-livepatch-develUpgrade dtb-apmUpgrade kernel-64kb-develUpgrade kernel-debugUpgrade kernel-syms-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-sourceUpgrade kselftests-kmp-defaultUpgrade dtb-amazonUpgrade dtb-appleUpgrade dtb-lgUpgrade gfs2-kmp-rtUpgrade kernel-symsUpgrade kernel-kvmsmall-develUpgrade kernel-zfcpdumpUpgrade kernel-azure-vdsoUpgrade kernel-default-manUpgrade dlm-kmp-azureUpgrade dtb-amlogicUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-64kb-optionalUpgrade gfs2-kmp-64kbUpgrade dtb-amdUpgrade kernel-default-optionalUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatchUpgrade kernel-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-syms-azureUpgrade kernel-obs-qaUpgrade dtb-mediatekUpgrade kernel-develUpgrade dtb-armUpgrade dtb-xilinxUpgrade kernel-debug-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debugUpgrade dtb-caviumUpgrade dtb-marvellUpgrade kselftests-kmp-azureUpgrade gfs2-kmp-azureUpgrade dtb-nvidiaUpgrade kernel-azureUpgrade kernel-azure-optionalUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-docsUpgrade kernel-rt-optionalUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-obs-buildUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-socionextUpgrade dtb-alteraUpgrade kernel-azure-develUpgrade cluster-md-kmp-rtUpgrade kernel-azure-baseUpgrade kernel-source-rtUpgrade kernel-rtUpgrade dtb-rockchipUpgrade dlm-kmp-defaultUpgrade kernel-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade dlm-kmp-rtUpgrade dtb-broadcomUpgrade ocfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade kernel-rt-extraUpgrade dtb-sprdUpgrade cluster-md-kmp-64kbUpgrade kernel-docs-htmlUpgrade kernel-default-vdsoUpgrade kernel-default-livepatch-develUpgrade dtb-qcomUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade kernel-preempt-develUpgrade dtb-renesasUpgrade reiserfs-kmp-rt | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-oracleUpgrade linux-image-oemUpgrade linux-image-4.15.0-1182-awsUpgrade linux-image-4.15.0-2120-aws-fipsUpgrade linux-image-kvmUpgrade linux-image-aws-lts-18.04Upgrade linux-image-virtualUpgrade linux-image-4.15.0-239-genericUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-4.15.0-1190-azureUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-azure-4.15Upgrade linux-image-gkeUpgrade linux-image-gcpUpgrade linux-image-4.15.0-2099-azure-fipsUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-oracle-4.15Upgrade linux-image-4.15.0-1165-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-239-lowlatencyUpgrade linux-image-aws-hweUpgrade linux-image-4.15.0-2083-gcp-fipsUpgrade linux-image-4.15.0-1137-fipsUpgrade linux-image-4.15.0-1175-gcpUpgrade linux-image-aws-fips-4.15Upgrade linux-image-azureUpgrade linux-image-aws-4.15Upgrade linux-image-gcp-fipsUpgrade linux-image-genericUpgrade linux-image-gcp-fips-4.15Upgrade linux-image-gcp-4.15Upgrade linux-image-azure-lts-18.04Upgrade linux-image-4.15.0-1144-oracleUpgrade linux-image-aws-fipsUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-azure-fips | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub