In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page.
NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly.
[[email protected]: NOTE added to the commit log]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade python-perfUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-4.14.327-246.539Upgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.198-187.748 | Aug 2, 2024 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-extraUpgrade dlm-kmp-azureUpgrade kernel-azureUpgrade dtb-allwinnerUpgrade kselftests-kmp-defaultUpgrade kernel-rt-optionalUpgrade dtb-amdUpgrade dtb-hisiliconUpgrade dtb-marvellUpgrade ocfs2-kmp-64kbUpgrade dtb-armUpgrade dtb-nvidiaUpgrade kernel-docsUpgrade kernel-syms-rtUpgrade kernel-source-vanillaUpgrade kernel-64kb-develUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-azureUpgrade dtb-renesasUpgrade kernel-debugUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade dtb-appleUpgrade kernel-azure-vdsoUpgrade kernel-rt_debugUpgrade kernel-debug-develUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-64kb-optionalUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade dtb-broadcomUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-socionextUpgrade dtb-sprdUpgrade kernel-rtUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade kernel-symsUpgrade kernel-default-extraUpgrade dtb-alteraUpgrade dtb-rockchipUpgrade kernel-devel-rtUpgrade kernel-rt-livepatchUpgrade kernel-sourceUpgrade kernel-azure-optionalUpgrade dtb-caviumUpgrade kernel-obs-qaUpgrade kernel-default-vdsoUpgrade dtb-amlogicUpgrade kernel-kvmsmall-develUpgrade dlm-kmp-64kbUpgrade dtb-apmUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmallUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-develUpgrade dtb-freescaleUpgrade dtb-lgUpgrade kernel-devel-azureUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-default-livepatchUpgrade kernel-macrosUpgrade dtb-qcomUpgrade gfs2-kmp-64kbUpgrade kernel-default-base-rebuildUpgrade kernel-64kbUpgrade dtb-mediatekUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-zfcpdumpUpgrade kernel-obs-buildUpgrade kernel-develUpgrade kernel-default-optionalUpgrade kernel-default-develUpgrade kernel-rt-develUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kselftests-kmp-64kbUpgrade dtb-amazonUpgrade dtb-xilinxUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-rt-vdso | Apr 17, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-image-4.15.0-1168-awsUpgrade linux-image-4.4.0-254-lowlatencyUpgrade linux-image-aws-hweUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.15.0-1131-oracleUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-gcpUpgrade linux-image-kvmUpgrade linux-image-awsUpgrade linux-image-4.15.0-1152-kvmUpgrade linux-image-4.4.0-1132-kvmUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-azureUpgrade linux-image-lowlatencyUpgrade linux-image-aws-lts-18.04Upgrade linux-image-4.15.0-1177-azureUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.15.0-225-lowlatencyUpgrade linux-image-oemUpgrade linux-image-oracleUpgrade linux-image-azure-lts-18.04Upgrade linux-image-genericUpgrade linux-image-4.4.0-1169-awsUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-gkeUpgrade linux-image-4.4.0-1131-awsUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-4.15.0-225-genericUpgrade linux-image-virtualUpgrade linux-image-4.4.0-254-genericUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.15.0-1162-gcp | May 20, 2024 | Mar 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub