In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page.
NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly.
[[email protected]: NOTE added to the commit log]
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernelUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.327-246.539Upgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-livepatch-5.10.198-187.748Upgrade kernel-headersUpgrade kernel-tools-debuginfo | Aug 2, 2024 | Mar 2, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 2, 2024 |
| Suse | — | Upgrade dtb-amdUpgrade kernel-debug-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debugUpgrade kernel-rt_debugUpgrade dtb-broadcomUpgrade kernel-64kb-develUpgrade gfs2-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-64kb-optionalUpgrade kernel-docsUpgrade kernel-azureUpgrade kernel-rt-optionalUpgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade dtb-marvellUpgrade dtb-sprdUpgrade dlm-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-source-vanillaUpgrade dtb-nvidiaUpgrade kselftests-kmp-rtUpgrade dtb-armUpgrade ocfs2-kmp-64kbUpgrade dtb-socionextUpgrade dtb-appleUpgrade kernel-default-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-source-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-rt-extraUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade dtb-renesasUpgrade dlm-kmp-rtUpgrade kernel-default-optionalUpgrade dlm-kmp-64kbUpgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade dtb-freescaleUpgrade kernel-default-develUpgrade dtb-rockchipUpgrade kernel-default-vdsoUpgrade gfs2-kmp-rtUpgrade dtb-amlogicUpgrade dtb-apmUpgrade kernel-kvmsmall-develUpgrade kernel-rtUpgrade dtb-mediatekUpgrade kernel-develUpgrade kernel-64kbUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-symsUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade dtb-qcomUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade kernel-rt-develUpgrade kernel-azure-optionalUpgrade kernel-sourceUpgrade kernel-rt-livepatchUpgrade kernel-devel-rtUpgrade kernel-devel-azureUpgrade dtb-alteraUpgrade kernel-64kb-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatchUpgrade dtb-exynosUpgrade kernel-syms-azureUpgrade kernel-macrosUpgrade dtb-amazonUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmallUpgrade dtb-lgUpgrade dtb-caviumUpgrade kernel-obs-qaUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-devel | Apr 17, 2024 | Mar 2, 2024 |
| Ubuntu | — | Upgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-gcpUpgrade linux-image-4.15.0-1131-oracleUpgrade linux-image-4.4.0-1132-kvmUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-aws-hweUpgrade linux-image-azureUpgrade linux-image-kvmUpgrade linux-image-4.15.0-1168-awsUpgrade linux-image-4.15.0-1152-kvmUpgrade linux-image-4.4.0-254-lowlatencyUpgrade linux-image-awsUpgrade linux-image-oemUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-oracleUpgrade linux-image-4.15.0-225-genericUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-azure-lts-18.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-4.4.0-1169-awsUpgrade linux-image-4.4.0-254-genericUpgrade linux-image-genericUpgrade linux-image-4.15.0-1177-azureUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-4.15.0-1162-gcpUpgrade linux-image-aws-lts-18.04Upgrade linux-image-4.4.0-1131-awsUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.15.0-225-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-virtual | May 20, 2024 | Mar 2, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 2, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub