In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix a use-after-free
There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed.
This commit fixes the following use-after-free:
================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-livepatch-5.15.164-108.161Upgrade kernel-livepatch-5.10.223-211.872Upgrade kernelUpgrade kernel-livepatch-5.10.217-205.860-debuginfoUpgrade kernel-livepatch-5.10.218-206.860-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.218-208.862Upgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.220-209.869Upgrade kernel-develUpgrade kernel-livepatch-5.10.218-206.860Upgrade kernel-livepatch-5.10.219-208.866Upgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.218-208.862-debuginfoUpgrade kernel-debuginfoUpgrade python-perfUpgrade perf-debuginfoUpgrade kernel-livepatch-5.10.220-209.867Upgrade kernel-livepatch-5.10.217-205.860 | Aug 14, 2024 | Apr 28, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade python3-perf | Oct 8, 2024 | Apr 28, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelists | Oct 8, 2024 | Apr 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 28, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-oracleUpgrade linux-image-awsUpgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-kvmUpgrade linux-image-azure-cvmUpgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gkeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-generic-lpaeUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1072-awsUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-azureUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-gke-5.15Upgrade linux-image-gcpUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-genericUpgrade linux-image-gkeopUpgrade linux-image-raspiUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-azure-lts-22.04Upgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-intel | Nov 12, 2024 | Apr 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub