In the Linux kernel, the following vulnerability has been resolved:
erofs: fix pcluster use-after-free on UP platforms
During stress testing with CONFIG_SMP disabled, KASAN reports as below:
================================================================== BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789
CPU: 0 PID: 7789 Comm: stress Not tainted 6.0.0-rc1-00002-g0d53d2e882f9 #3 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> .. __mutex_lock+0xe5/0xc30 .. z_erofs_do_read_page+0x8ce/0x1560 .. z_erofs_readahead+0x31c/0x580 .. Freed by task 7787 kasan_save_stack+0x1e/0x40 kasan_set_track+0x20/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free+0x10c/0x190 kmem_cache_free+0xed/0x380 rcu_core+0x3d5/0xc90 __do_softirq+0x12d/0x389
Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x97/0xb0 call_rcu+0x3d/0x3f0 erofs_shrink_workstation+0x11f/0x210 erofs_shrink_scan+0xdc/0x170 shrink_slab.constprop.0+0x296/0x530 drop_slab+0x1c/0x70 drop_caches_sysctl_handler+0x70/0x80 proc_sys_call_handler+0x20a/0x2f0 vfs_write+0x555/0x6c0 ksys_write+0xbe/0x160 do_syscall_64+0x3b/0x90
The root cause is that erofs_workgroup_unfreeze() doesn't reset to orig_val thus it causes a race that the pcluster reuses unexpectedly before freeing.
Since UP platforms are quite rare now, such path becomes unnecessary. Let's drop such specific-designed path directly instead.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Ubuntu | — | Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-gcpUpgrade linux-image-gkeop-5.4Upgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-1134-gcpUpgrade linux-image-5.4.0-192-generic-lpaeUpgrade linux-image-5.4.0-1118-kvmUpgrade linux-image-ibmUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-virtualUpgrade linux-image-gkeopUpgrade linux-image-bluefieldUpgrade linux-image-5.4.0-1135-azureUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-raspi2Upgrade linux-image-genericUpgrade linux-image-azure-lts-20.04Upgrade linux-image-5.4.0-1114-raspiUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-oem-osp1Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1049-xilinx-zynqmpUpgrade linux-image-5.4.0-1130-awsUpgrade linux-image-5.4.0-1097-gkeopUpgrade linux-image-5.4.0-1090-bluefieldUpgrade linux-image-5.4.0-1042-iotUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-awsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracleUpgrade linux-image-5.4.0-192-lowlatencyUpgrade linux-image-oemUpgrade linux-image-5.4.0-1077-ibmUpgrade linux-image-kvmUpgrade linux-image-azureUpgrade linux-image-5.4.0-192-genericUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1129-oracleUpgrade linux-image-generic-hwe-18.04 | Aug 9, 2024 | May 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub