In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Fix a use-after-free
There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still available when .exit_cmd_priv is called by waiting inside scsi_remove_host() until the tag set has been freed.
This commit fixes the following use-after-free:
================================================================== BUG: KASAN: use-after-free in srp_exit_cmd_priv+0x27/0xd0 [ib_srp] Read of size 8 at addr ffff888100337000 by task multipathd/16727 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x5e/0x5db kasan_report+0xab/0x120 srp_exit_cmd_priv+0x27/0xd0 [ib_srp] scsi_mq_exit_request+0x4d/0x70 blk_mq_free_rqs+0x143/0x410 __blk_mq_free_map_and_rqs+0x6e/0x100 blk_mq_free_tag_set+0x2b/0x160 scsi_host_dev_release+0xf3/0x1a0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_device_dev_release_usercontext+0x4c1/0x4e0 execute_in_process_context+0x23/0x90 device_release+0x54/0xe0 kobject_put+0xa5/0x120 scsi_disk_release+0x3f/0x50 device_release+0x54/0xe0 kobject_put+0xa5/0x120 disk_release+0x17f/0x1b0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 dm_put_table_device+0xa3/0x160 [dm_mod] dm_put_device+0xd0/0x140 [dm_mod] free_priority_group+0xd8/0x110 [dm_multipath] free_multipath+0x94/0xe0 [dm_multipath] dm_table_destroy+0xa2/0x1e0 [dm_mod] __dm_destroy+0x196/0x350 [dm_mod] dev_remove+0x10c/0x160 [dm_mod] ctl_ioctl+0x2c2/0x590 [dm_mod] dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 dm_ctl_ioctl+0x5/0x10 [dm_mod] __x64_sys_ioctl+0xb4/0xf0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.10.219-208.866Upgrade kernel-toolsUpgrade kernel-livepatch-5.10.220-209.869Upgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.218-208.862-debuginfoUpgrade kernel-livepatch-5.10.217-205.860Upgrade python-perf-debuginfoUpgrade perfUpgrade kernel-develUpgrade kernel-livepatch-5.10.220-209.867Upgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.218-206.860Upgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.218-208.862Upgrade python-perfUpgrade kernel-livepatch-5.10.223-211.872Upgrade kernelUpgrade kernel-livepatch-5.10.218-206.860-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-livepatch-5.15.164-108.161Upgrade kernel-livepatch-5.10.217-205.860-debuginfo | Aug 14, 2024 | Apr 28, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 28, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel | Oct 8, 2024 | Apr 28, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Oct 8, 2024 | Apr 28, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 28, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1065-raspiUpgrade linux-image-5.15.0-125-lowlatencyUpgrade linux-image-intelUpgrade linux-image-5.15.0-1067-nvidiaUpgrade linux-image-genericUpgrade linux-image-5.15.0-1078-azureUpgrade linux-image-azure-lts-22.04Upgrade linux-image-gkeopUpgrade linux-image-5.15.0-1071-gcpUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1075-azureUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-raspiUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1069-gkeUpgrade linux-image-5.15.0-125-genericUpgrade linux-image-intel-iotgUpgrade linux-image-azureUpgrade linux-image-gcpUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-20.04cUpgrade linux-image-aws-lts-22.04Upgrade linux-image-ibmUpgrade linux-image-5.15.0-1072-awsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1067-nvidia-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-1065-ibmUpgrade linux-image-5.15.0-1069-kvmUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1055-gkeopUpgrade linux-image-oem-20.04dUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-125-generic-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1038-xilinx-zynqmpUpgrade linux-image-5.15.0-125-generic-lpaeUpgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-125-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-azure-cvmUpgrade linux-image-5.15.0-1070-oracleUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-kvmUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1067-intel-iotgUpgrade linux-image-oracleUpgrade linux-image-aws | Nov 12, 2024 | Apr 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub