In the Linux kernel, the following vulnerability has been resolved:
RDMA/ucma: Protect mc during concurrent multicast leaves
Partially revert the commit mentioned in the Fixes line to make sure that allocation and erasing multicast struct are locked.
BUG: KASAN: use-after-free in ucma_cleanup_multicast drivers/infiniband/core/ucma.c:491 [inline] BUG: KASAN: use-after-free in ucma_destroy_private_ctx+0x914/0xb70 drivers/infiniband/core/ucma.c:579 Read of size 8 at addr ffff88801bb74b00 by task syz-executor.1/25529 CPU: 0 PID: 25529 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 ucma_cleanup_multicast drivers/infiniband/core/ucma.c:491 [inline] ucma_destroy_private_ctx+0x914/0xb70 drivers/infiniband/core/ucma.c:579 ucma_destroy_id+0x1e6/0x280 drivers/infiniband/core/ucma.c:614 ucma_write+0x25c/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xae0 fs/read_write.c:588 ksys_write+0x1ee/0x250 fs/read_write.c:643 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae
Currently the xarray search can touch a concurrently freeing mc as the xa_for_each() is not surrounded by any lock. Rather than hold the lock for a full scan hold it only for the effected items, which is usually an empty list.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-toolsUpgrade kernel-headersUpgrade python-perfUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade perfUpgrade kernel-livepatch-5.10.102-99.473Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade bpftoolUpgrade kernel | Aug 2, 2024 | Jun 20, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 20, 2024 |
| Suse | — | Upgrade kernel-64kb-develUpgrade kernel-defaultUpgrade kernel-rt_debugUpgrade kernel-syms-rtUpgrade kernel-syms-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade kernel-devel-rtUpgrade kernel-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-azure-develUpgrade dlm-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-docsUpgrade kernel-rt-develUpgrade gfs2-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-obs-buildUpgrade kernel-default-develUpgrade kernel-azure-optionalUpgrade kernel-source-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-sourceUpgrade gfs2-kmp-azureUpgrade kernel-source-rtUpgrade kernel-preemptUpgrade kselftests-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-preempt-develUpgrade kernel-azure-extraUpgrade kernel-rt-extraUpgrade kernel-azureUpgrade cluster-md-kmp-rtUpgrade kernel-64kbUpgrade kernel-develUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-develUpgrade ocfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-default-base | Aug 9, 2024 | Jun 20, 2024 |
| Ubuntu | — | Upgrade linux-intel-iotg-5.15 | Nov 19, 2024 | Jun 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Jun 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub