In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd
KASAN reports a use-after-free report when doing fuzz test:
[693354.104835] ================================================================== [693354.105094] BUG: KASAN: use-after-free in bfq_io_set_weight_legacy+0xd3/0x160 [693354.105336] Read of size 4 at addr ffff888be0a35664 by task sh/1453338
[693354.105607] CPU: 41 PID: 1453338 Comm: sh Kdump: loaded Not tainted 4.18.0-147 [693354.105610] Hardware name: Huawei 2288H V5/BC11SPSCB0, BIOS 0.81 07/02/2018 [693354.105612] Call Trace: [693354.105621] dump_stack+0xf1/0x19b [693354.105626] ? show_regs_print_info+0x5/0x5 [693354.105634] ? printk+0x9c/0xc3 [693354.105638] ? cpumask_weight+0x1f/0x1f [693354.105648] print_address_description+0x70/0x360 [693354.105654] kasan_report+0x1b2/0x330 [693354.105659] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105665] ? bfq_io_set_weight_legacy+0xd3/0x160 [693354.105670] bfq_io_set_weight_legacy+0xd3/0x160 [693354.105675] ? bfq_cpd_init+0x20/0x20 [693354.105683] cgroup_file_write+0x3aa/0x510 [693354.105693] ? ___slab_alloc+0x507/0x540 [693354.105698] ? cgroup_file_poll+0x60/0x60 [693354.105702] ? 0xffffffff89600000 [693354.105708] ? usercopy_abort+0x90/0x90 [693354.105716] ? mutex_lock+0xef/0x180 [693354.105726] kernfs_fop_write+0x1ab/0x280 [693354.105732] ? cgroup_file_poll+0x60/0x60 [693354.105738] vfs_write+0xe7/0x230 [693354.105744] ksys_write+0xb0/0x140 [693354.105749] ? __ia32_sys_read+0x50/0x50 [693354.105760] do_syscall_64+0x112/0x370 [693354.105766] ? syscall_return_slowpath+0x260/0x260 [693354.105772] ? do_page_fault+0x9b/0x270 [693354.105779] ? prepare_exit_to_usermode+0xf9/0x1a0 [693354.105784] ? enter_from_user_mode+0x30/0x30 [693354.105793] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.105875] Allocated by task 1453337: [693354.106001] kasan_kmalloc+0xa0/0xd0 [693354.106006] kmem_cache_alloc_node_trace+0x108/0x220 [693354.106010] bfq_pd_alloc+0x96/0x120 [693354.106015] blkcg_activate_policy+0x1b7/0x2b0 [693354.106020] bfq_create_group_hierarchy+0x1e/0x80 [693354.106026] bfq_init_queue+0x678/0x8c0 [693354.106031] blk_mq_init_sched+0x1f8/0x460 [693354.106037] elevator_switch_mq+0xe1/0x240 [693354.106041] elevator_switch+0x25/0x40 [693354.106045] elv_iosched_store+0x1a1/0x230 [693354.106049] queue_attr_store+0x78/0xb0 [693354.106053] kernfs_fop_write+0x1ab/0x280 [693354.106056] vfs_write+0xe7/0x230 [693354.106060] ksys_write+0xb0/0x140 [693354.106064] do_syscall_64+0x112/0x370 [693354.106069] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.106114] Freed by task 1453336: [693354.106225] __kasan_slab_free+0x130/0x180 [693354.106229] kfree+0x90/0x1b0 [693354.106233] blkcg_deactivate_policy+0x12c/0x220 [693354.106238] bfq_exit_queue+0xf5/0x110 [693354.106241] blk_mq_exit_sched+0x104/0x130 [693354.106245] __elevator_exit+0x45/0x60 [693354.106249] elevator_switch_mq+0xd6/0x240 [693354.106253] elevator_switch+0x25/0x40 [693354.106257] elv_iosched_store+0x1a1/0x230 [693354.106261] queue_attr_store+0x78/0xb0 [693354.106264] kernfs_fop_write+0x1ab/0x280 [693354.106268] vfs_write+0xe7/0x230 [693354.106271] ksys_write+0xb0/0x140 [693354.106275] do_syscall_64+0x112/0x370 [693354.106280] entry_SYSCALL_64_after_hwframe+0x65/0xca
[693354.106329] The buggy address belongs to the object at ffff888be0a35580 which belongs to the cache kmalloc-1k of size 1024 [693354.106736] The buggy address is located 228 bytes inside of 1024-byte region [ffff888be0a35580, ffff888be0a35980) [693354.107114] The buggy address belongs to the page: [693354.107273] page:ffffea002f828c00 count:1 mapcount:0 mapping:ffff888107c17080 index:0x0 compound_mapcount: 0 [693354.107606] flags: 0x17ffffc0008100(slab|head) [693354.107760] raw: 0017ffffc0008100 ffffea002fcbc808 ffffea0030bd3a08 ffff888107c17080 [693354.108020] r ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.75-79.358Upgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernelUpgrade perf-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade python-perf-debuginfo | Dec 12, 2024 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 21, 2024 |
| Suse | — | Upgrade kernel-default-manUpgrade dtb-armUpgrade kernel-64kbUpgrade ocfs2-kmp-rtUpgrade dtb-amdUpgrade dlm-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-livepatchUpgrade dtb-hisiliconUpgrade cluster-md-kmp-azureUpgrade dtb-xilinxUpgrade kernel-develUpgrade kernel-obs-qaUpgrade reiserfs-kmp-defaultUpgrade kernel-syms-azureUpgrade kselftests-kmp-defaultUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade gfs2-kmp-64kbUpgrade kernel-default-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade kernel-syms-rtUpgrade dtb-appleUpgrade gfs2-kmp-rtUpgrade dtb-amazonUpgrade kernel-64kb-develUpgrade dlm-kmp-64kbUpgrade kernel-debug-develUpgrade dtb-lgUpgrade kernel-azure-vdsoUpgrade dtb-freescaleUpgrade kernel-azure-livepatch-develUpgrade kernel-default-extraUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade dtb-apmUpgrade kernel-debugUpgrade kernel-kvmsmall-develUpgrade kernel-devel-azureUpgrade kernel-rt-develUpgrade kernel-preemptUpgrade kernel-source-azureUpgrade dtb-amlogicUpgrade kernel-azure-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-sourceUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-source-rtUpgrade kselftests-kmp-azureUpgrade kernel-rt-extraUpgrade cluster-md-kmp-64kbUpgrade dtb-allwinnerUpgrade dtb-sprdUpgrade kernel-docs-htmlUpgrade kernel-default-baseUpgrade dtb-qcomUpgrade kernel-default-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-rt_debug-develUpgrade kernel-azure-develUpgrade kernel-obs-buildUpgrade dtb-nvidiaUpgrade dtb-socionextUpgrade dtb-alteraUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-baseUpgrade kernel-rt-optionalUpgrade kselftests-kmp-rtUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-azureUpgrade kernel-defaultUpgrade gfs2-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-azureUpgrade dtb-rockchipUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade ocfs2-kmp-64kbUpgrade kernel-docsUpgrade kernel-preempt-develUpgrade kernel-azure-optionalUpgrade dtb-renesasUpgrade ocfs2-kmp-defaultUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade dtb-marvellUpgrade dtb-caviumUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-rtUpgrade kernel-rt_debug | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-azure-lts-18.04Upgrade linux-image-4.15.0-239-lowlatencyUpgrade linux-image-gcp-fips-4.15Upgrade linux-image-4.15.0-1137-fipsUpgrade linux-image-aws-fips-4.15Upgrade linux-image-aws-hweUpgrade linux-image-azure-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-azureUpgrade linux-image-fipsUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gcp-fipsUpgrade linux-image-4.15.0-1175-gcpUpgrade linux-image-genericUpgrade linux-image-aws-fipsUpgrade linux-image-aws-4.15Upgrade linux-image-gcp-4.15Upgrade linux-image-4.15.0-1144-oracleUpgrade linux-image-4.15.0-2083-gcp-fipsUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.15.0-1165-kvmUpgrade linux-image-4.15.0-2120-aws-fipsUpgrade linux-image-4.15.0-2099-azure-fipsUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-azure-4.15Upgrade linux-image-virtualUpgrade linux-image-4.15.0-239-genericUpgrade linux-image-gcpUpgrade linux-image-aws-lts-18.04Upgrade linux-image-oracleUpgrade linux-image-kvmUpgrade linux-image-oemUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-4.15.0-1182-awsUpgrade linux-image-4.15.0-1190-azureUpgrade linux-image-oracle-4.15Upgrade linux-image-gke | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub