In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries.
To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb.
This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-rtUpgrade kernel-debug-modulesUpgrade perfUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-tools-libsUpgrade kernel-rt-modules-extraUpgrade kernel-rt-develUpgrade kernelUpgrade kernel-debugUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debugUpgrade bpftoolUpgrade kernel-modules-extraUpgrade kernel-rt-modulesUpgrade kernel-debug-coreUpgrade kernel-cross-headersUpgrade kernel-develUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-coreUpgrade kernel-rt-kvmUpgrade kernel-zfcpdumpUpgrade kernel-abi-stablelistsUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade kernel-headersUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-modules-extraUpgrade kernel-docUpgrade kernel-debug-develUpgrade kernel-zfcpdump-coreUpgrade kernel-zfcpdump-modules | Aug 12, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade kernel-livepatch-5.15.145-95.156Upgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.205-195.804Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-4.14.349-266.564Upgrade kernel-headersUpgrade python-perf-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel | Jun 26, 2024 | May 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade python3-perfUpgrade kernel-livepatch-6.1.66-91.160Upgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-libbpf-staticUpgrade bpftool | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-tools | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Aug 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Aug 12, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade kernel-rt-debug-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-develUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-debugUpgrade kernel-debug-modulesUpgrade kernel-debuginfoUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade kernel-cross-headersUpgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade bpftool-debuginfoUpgrade kernel-rt-debuginfoUpgrade kernel-coreUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-modulesUpgrade kernel-debug-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-kvmUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-develUpgrade perfUpgrade kernel-toolsUpgrade kernel-rtUpgrade kernel-rt-modulesUpgrade kernel-headersUpgrade kernel-rt-debug-kvmUpgrade python3-perfUpgrade perf-debuginfo | Aug 22, 2024 | May 21, 2024 |
| Suse | — | Upgrade gfs2-kmp-defaultUpgrade kernel-debugUpgrade dtb-armUpgrade kernel-default-vdsoUpgrade cluster-md-kmp-rtUpgrade dtb-lgUpgrade kernel-default-optionalUpgrade dtb-allwinnerUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-develUpgrade dtb-exynosUpgrade kernel-devel-azureUpgrade dtb-rockchipUpgrade dtb-alteraUpgrade kernel-64kbUpgrade kernel-source-vanillaUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-azureUpgrade dtb-mediatekUpgrade kernel-rt_debug-develUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-zfcpdumpUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-xilinxUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade dtb-amazonUpgrade gfs2-kmp-rtUpgrade kernel-rt-develUpgrade kernel-symsUpgrade kernel-azureUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade kernel-azure-optionalUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-64kbUpgrade dtb-freescaleUpgrade kernel-devel-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade kernel-default-develUpgrade kernel-develUpgrade dtb-qcomUpgrade gfs2-kmp-64kbUpgrade dtb-caviumUpgrade cluster-md-kmp-azureUpgrade dlm-kmp-rtUpgrade kernel-default-extraUpgrade dtb-socionextUpgrade kernel-kvmsmallUpgrade kernel-macrosUpgrade cluster-md-kmp-defaultUpgrade kernel-defaultUpgrade kernel-obs-qaUpgrade kernel-azure-livepatch-develUpgrade dtb-marvellUpgrade dtb-hisiliconUpgrade kernel-source-rtUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-develUpgrade reiserfs-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-livepatch-develUpgrade kernel-default-manUpgrade kernel-default-livepatchUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-baseUpgrade kernel-rt_debugUpgrade kernel-rt-vdsoUpgrade dtb-sprdUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade kselftests-kmp-defaultUpgrade kernel-azure-develUpgrade kselftests-kmp-rtUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-docsUpgrade dtb-renesasUpgrade kernel-obs-buildUpgrade dtb-broadcomUpgrade kernel-rt-optionalUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-extraUpgrade kernel-default-baseUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade dtb-nvidiaUpgrade dtb-apm | Jun 12, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-gkeop-5.4Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-azureUpgrade linux-image-ibmUpgrade linux-image-5.4.0-1131-oracleUpgrade linux-image-5.4.0-1092-bluefieldUpgrade linux-image-awsUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1099-gkeopUpgrade linux-image-oemUpgrade linux-image-lowlatencyUpgrade linux-image-aws-lts-20.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1043-iotUpgrade linux-image-kvmUpgrade linux-image-5.4.0-1079-ibmUpgrade linux-image-5.4.0-1120-kvmUpgrade linux-image-gkeopUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-1051-xilinx-zynqmpUpgrade linux-image-genericUpgrade linux-image-5.4.0-1136-gcpUpgrade linux-image-5.4.0-195-genericUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-oem-osp1Upgrade linux-image-bluefieldUpgrade linux-image-virtualUpgrade linux-image-raspi2-hwe-18.04Upgrade linux-image-5.4.0-1137-azureUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-raspi2Upgrade linux-image-5.4.0-195-generic-lpaeUpgrade linux-image-gcpUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-oracleUpgrade linux-image-5.4.0-1132-awsUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-lts-20.04Upgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-195-lowlatencyUpgrade linux-image-5.4.0-1116-raspi | Sep 13, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub