In the Linux kernel, the following vulnerability has been resolved:
drbd: Fix five use after free bugs in get_initial_state
In get_initial_state, it calls notify_initial_state_done(skb,..) if cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), the skb will be freed by nlmsg_free(skb). Then get_initial_state will goto out and the freed skb will be used by return value skb->len, which is a uaf bug.
What's worse, the same problem goes even further: skb can also be freed in the notify_*_state_change -> notify_*_state calls below. Thus 4 additional uaf bugs happened.
My patch lets the problem callee functions: notify_initial_state_done and notify_*_state_change return an error code if errors happen. So that the error codes could be propagated and the uaf bugs can be avoid.
v2 reports a compilation warning. This v3 fixed this warning and built successfully in my local environment with no additional warnings. v2: https://lore.kernel.org/patchwork/patch/1435218/
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-livepatch-5.10.112-108.499Upgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernelUpgrade bpftoolUpgrade kernel-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.276-211.499 | Apr 10, 2025 | Feb 26, 2025 |
| Amazon_linux | — | Upgrade kernel | Apr 10, 2025 | Jun 9, 2022 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Ubuntu | — | Upgrade linux-lowlatency-hwe-5.15Upgrade linux-gcp-4.15Upgrade linux-intel-iotgUpgrade linux-intel-iotg-5.15Upgrade linux-aws-5.4Upgrade linux-fipsUpgrade linux-oracleUpgrade linux-ibmUpgrade linux-azure-5.4Upgrade linux-azure-5.15Upgrade linux-hweUpgrade linux-iotUpgrade linux-azureUpgrade linux-raspi-5.4Upgrade linux-hwe-5.15Upgrade linux-bluefieldUpgrade linux-azure-4.15Upgrade linux-kvmUpgrade linux-raspiUpgrade linux-realtimeUpgrade linux-ibm-5.4Upgrade linux-azure-fipsUpgrade linux-gkeUpgrade linux-aws-fipsUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-lowlatencyUpgrade linux-awsUpgrade linux-aws-hweUpgrade linuxUpgrade linux-gcp-fipsUpgrade linux-oracle-5.4Upgrade linux-hwe-5.4 | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub