In the Linux kernel, the following vulnerability has been resolved:
sata_fsl: fix UAF in sata_fsl_port_stop when rmmod sata_fsl
When the `rmmod sata_fsl.ko` command is executed in the PPC64 GNU/Linux, a bug is reported: ================================================================== BUG: Unable to handle kernel data access on read at 0x80000800805b502c Oops: Kernel access of bad area, sig: 11 [#1] NIP [c0000000000388a4] .ioread32+0x4/0x20 LR [80000000000c6034] .sata_fsl_port_stop+0x44/0xe0 [sata_fsl] Call Trace: .free_irq+0x1c/0x4e0 (unreliable) .ata_host_stop+0x74/0xd0 [libata] .release_nodes+0x330/0x3f0 .device_release_driver_internal+0x178/0x2c0 .driver_detach+0x64/0xd0 .bus_remove_driver+0x70/0xf0 .driver_unregister+0x38/0x80 .platform_driver_unregister+0x14/0x30 .fsl_sata_driver_exit+0x18/0xa20 [sata_fsl] .__se_sys_delete_module+0x1ec/0x2d0 .system_call_exception+0xfc/0x1f0 system_call_common+0xf8/0x200 ==================================================================
The triggering of the BUG is shown in the following stack:
driver_detach device_release_driver_internal __device_release_driver drv->remove(dev) --> platform_drv_remove/platform_remove drv->remove(dev) --> sata_fsl_remove iounmap(host_priv->hcr_base); <---- unmap kfree(host_priv); <---- free devres_release_all release_nodes dr->node.release(dev, dr->data) --> ata_host_stop ap->ops->port_stop(ap) --> sata_fsl_port_stop ioread32(hcr_base + HCONTROL) <---- UAF host->ops->host_stop(host)
The iounmap(host_priv->hcr_base) and kfree(host_priv) functions should not be executed in drv->remove. These functions should be executed in host_stop after port_stop. Therefore, we move these functions to the new function sata_fsl_host_stop and bind the new function to host_stop.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade gfs2-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-64kb-livepatch-develUpgrade dtb-hisiliconUpgrade cluster-md-kmp-rtUpgrade dtb-mediatekUpgrade dtb-renesasUpgrade dtb-amazonUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-default-develUpgrade reiserfs-kmp-defaultUpgrade kernel-preempt-develUpgrade kernel-default-livepatchUpgrade kernel-rt_debugUpgrade cluster-md-kmp-azureUpgrade kernel-defaultUpgrade dtb-xilinxUpgrade kernel-devel-rtUpgrade ocfs2-kmp-azureUpgrade kernel-debugUpgrade kernel-symsUpgrade kernel-zfcpdumpUpgrade kernel-64kb-develUpgrade kernel-debug-develUpgrade kernel-rt-develUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade dtb-alteraUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatchUpgrade kernel-azure-optionalUpgrade kernel-64kbUpgrade cluster-md-kmp-64kbUpgrade kernel-64kb-extraUpgrade dtb-appleUpgrade dtb-socionextUpgrade kernel-default-baseUpgrade kernel-default-optionalUpgrade dtb-marvellUpgrade dtb-armUpgrade kernel-azure-extraUpgrade kernel-docsUpgrade dtb-amdUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-caviumUpgrade ocfs2-kmp-rtUpgrade kernel-develUpgrade dtb-freescaleUpgrade dlm-kmp-defaultUpgrade dtb-sprdUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-livepatch-develUpgrade gfs2-kmp-64kbUpgrade dtb-apmUpgrade kernel-azure-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-sourceUpgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade dtb-exynosUpgrade kernel-macrosUpgrade kernel-azure-develUpgrade dlm-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-default-extraUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-nvidiaUpgrade kernel-docs-htmlUpgrade kernel-preemptUpgrade kernel-rt-livepatch-develUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade kernel-debug-vdsoUpgrade reiserfs-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-rtUpgrade dtb-amlogicUpgrade kernel-rt-extraUpgrade kernel-source-azureUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-azureUpgrade kernel-rtUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-64kbUpgrade kernel-kvmsmallUpgrade kernel-rt_debug-vdsoUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade kernel-syms-azureUpgrade dtb-qcomUpgrade dtb-broadcomUpgrade kernel-obs-buildUpgrade kernel-default-vdsoUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade kernel-azure | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | Upgrade linux-gkeopUpgrade linux-gcp-fipsUpgrade linux-gcpUpgrade linux-fipsUpgrade linuxUpgrade linux-gcp-5.4Upgrade linux-azure-fipsUpgrade linux-awsUpgrade linux-hwe-5.4Upgrade linux-oracle-5.4Upgrade linux-ibm-5.4Upgrade linux-azure-4.15Upgrade linux-raspi-5.4Upgrade linux-aws-fipsUpgrade linux-bluefieldUpgrade linux-aws-5.4Upgrade linux-ibmUpgrade linux-gcp-4.15Upgrade linux-azureUpgrade linux-raspiUpgrade linux-kvmUpgrade linux-azure-5.4Upgrade linux-oracleUpgrade linux-hweUpgrade linux-aws-hwe | Nov 19, 2024 | May 24, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub