In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries.
To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb.
This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-docUpgrade kernel-zfcpdumpUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-coreUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade kernel-zfcpdump-develUpgrade kernel-debug-develUpgrade bpftoolUpgrade python3-perfUpgrade kernel-rtUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-cross-headersUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-debug-modulesUpgrade kernelUpgrade perfUpgrade kernel-develUpgrade kernel-tools | Aug 12, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-tools-develUpgrade kernel-livepatch-4.14.349-266.564Upgrade kernelUpgrade kernel-toolsUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.15.145-95.156Upgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.205-195.804Upgrade kernel-develUpgrade bpftool | Jun 26, 2024 | May 21, 2024 |
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade kernel-develUpgrade kernel-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade kernel-livepatch-6.1.66-91.160Upgrade perfUpgrade kernel-modules-extraUpgrade bpftool | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Aug 16, 2024 | May 21, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Aug 12, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-modulesUpgrade kernel-cross-headersUpgrade kernel-rt-debug-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-coreUpgrade kernel-rt-kvmUpgrade kernel-develUpgrade kernel-debug-coreUpgrade kernel-rt-debugUpgrade kernel-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade kernel-rt-modules-extraUpgrade bpftoolUpgrade kernel-debug-modulesUpgrade python3-perf-debuginfoUpgrade kernel-modules-extraUpgrade kernel-tools-libsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debugUpgrade kernel-debug-develUpgrade perf-debuginfoUpgrade kernel-rtUpgrade kernel-toolsUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade perfUpgrade kernel-rt-debug-develUpgrade kernel-rt-debug-kvmUpgrade python3-perfUpgrade kernel-rt-modulesUpgrade kernel-headers | Aug 22, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-kvmsmall-livepatch-develUpgrade dlm-kmp-defaultUpgrade kernel-azure-livepatch-develUpgrade kernel-obs-qaUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade dtb-hisiliconUpgrade dtb-amdUpgrade kernel-default-livepatchUpgrade kernel-default-manUpgrade kernel-64kb-optionalUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade dtb-marvellUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade dlm-kmp-azureUpgrade kernel-rt-vdsoUpgrade kernel-debug-develUpgrade kernel-source-rtUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-default-baseUpgrade dtb-apmUpgrade dtb-socionextUpgrade kernel-default-extraUpgrade kernel-azure-extraUpgrade dtb-sprdUpgrade kernel-azure-baseUpgrade cluster-md-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-rt_debugUpgrade dtb-appleUpgrade dlm-kmp-rtUpgrade kernel-docsUpgrade kernel-docs-htmlUpgrade dtb-renesasUpgrade kernel-obs-buildUpgrade ocfs2-kmp-rtUpgrade kernel-defaultUpgrade kernel-rt-optionalUpgrade dtb-nvidiaUpgrade kernel-azure-develUpgrade kernel-default-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-syms-rtUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-debug-livepatch-develUpgrade dtb-exynosUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-devel-rtUpgrade kernel-rt-develUpgrade kernel-debugUpgrade dtb-allwinnerUpgrade kernel-kvmsmall-develUpgrade kernel-debug-vdsoUpgrade kernel-zfcpdumpUpgrade kernel-source-vanillaUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade kernel-64kb-develUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatchUpgrade dtb-amazonUpgrade kernel-default-develUpgrade kernel-syms-azureUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-64kbUpgrade dtb-xilinxUpgrade dtb-freescaleUpgrade dtb-rockchipUpgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade dtb-armUpgrade dtb-lgUpgrade kselftests-kmp-azureUpgrade kernel-64kb-extraUpgrade kernel-devel-azureUpgrade kernel-azure-optionalUpgrade dtb-alteraUpgrade ocfs2-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-rt_debug-develUpgrade kernel-rtUpgrade ocfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-sourceUpgrade gfs2-kmp-64kbUpgrade kernel-azureUpgrade kernel-symsUpgrade kselftests-kmp-64kbUpgrade dtb-caviumUpgrade dtb-qcom | Jun 12, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-gkeopUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtualUpgrade linux-image-5.4.0-1137-azureUpgrade linux-image-bluefieldUpgrade linux-image-gcpUpgrade linux-image-raspi2-hwe-18.04Upgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1116-raspiUpgrade linux-image-oracleUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-195-genericUpgrade linux-image-5.4.0-1051-xilinx-zynqmpUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-azure-lts-20.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-195-generic-lpaeUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1132-awsUpgrade linux-image-raspi2Upgrade linux-image-5.4.0-1043-iotUpgrade linux-image-genericUpgrade linux-image-5.4.0-195-lowlatencyUpgrade linux-image-5.4.0-1136-gcpUpgrade linux-image-azureUpgrade linux-image-ibmUpgrade linux-image-raspiUpgrade linux-image-oemUpgrade linux-image-5.4.0-1131-oracleUpgrade linux-image-awsUpgrade linux-image-5.4.0-1092-bluefieldUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1099-gkeopUpgrade linux-image-lowlatencyUpgrade linux-image-gkeop-5.4Upgrade linux-image-kvmUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.4.0-1079-ibmUpgrade linux-image-5.4.0-1120-kvmUpgrade linux-image-generic-hwe-18.04 | Sep 13, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub