In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir() workqueue,which takes care about pipefs superblock locking. In some special scenarios, when kernel frees the pipefs sb of the current client and immediately alloctes a new pipefs sb, rpc_remove_pipedir function would misjudge the existence of pipefs sb which is not the one it used to hold. As a result, the rpc_remove_pipedir would clean the released freed pipefs dentries.
To fix this issue, rpc_remove_pipedir should check whether the current pipefs sb is consistent with the original pipefs sb.
This error can be catched by KASAN: ========================================================= [ 250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200 [ 250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503 [ 250.500549] Workqueue: events rpc_free_client_work [ 250.501001] Call Trace: [ 250.502880] kasan_report+0xb6/0xf0 [ 250.503209] ? dget_parent+0x195/0x200 [ 250.503561] dget_parent+0x195/0x200 [ 250.503897] ? __pfx_rpc_clntdir_depopulate+0x10/0x10 [ 250.504384] rpc_rmdir_depopulate+0x1b/0x90 [ 250.504781] rpc_remove_client_dir+0xf5/0x150 [ 250.505195] rpc_free_client_work+0xe4/0x230 [ 250.505598] process_one_work+0x8ee/0x13b0 ... [ 22.039056] Allocated by task 244: [ 22.039390] kasan_save_stack+0x22/0x50 [ 22.039758] kasan_set_track+0x25/0x30 [ 22.040109] __kasan_slab_alloc+0x59/0x70 [ 22.040487] kmem_cache_alloc_lru+0xf0/0x240 [ 22.040889] __d_alloc+0x31/0x8e0 [ 22.041207] d_alloc+0x44/0x1f0 [ 22.041514] __rpc_lookup_create_exclusive+0x11c/0x140 [ 22.041987] rpc_mkdir_populate.constprop.0+0x5f/0x110 [ 22.042459] rpc_create_client_dir+0x34/0x150 [ 22.042874] rpc_setup_pipedir_sb+0x102/0x1c0 [ 22.043284] rpc_client_register+0x136/0x4e0 [ 22.043689] rpc_new_client+0x911/0x1020 [ 22.044057] rpc_create_xprt+0xcb/0x370 [ 22.044417] rpc_create+0x36b/0x6c0 ... [ 22.049524] Freed by task 0: [ 22.049803] kasan_save_stack+0x22/0x50 [ 22.050165] kasan_set_track+0x25/0x30 [ 22.050520] kasan_save_free_info+0x2b/0x50 [ 22.050921] __kasan_slab_free+0x10e/0x1a0 [ 22.051306] kmem_cache_free+0xa5/0x390 [ 22.051667] rcu_core+0x62c/0x1930 [ 22.051995] __do_softirq+0x165/0x52a [ 22.052347] [ 22.052503] Last potentially related work creation: [ 22.052952] kasan_save_stack+0x22/0x50 [ 22.053313] __kasan_record_aux_stack+0x8e/0xa0 [ 22.053739] __call_rcu_common.constprop.0+0x6b/0x8b0 [ 22.054209] dentry_free+0xb2/0x140 [ 22.054540] __dentry_kill+0x3be/0x540 [ 22.054900] shrink_dentry_list+0x199/0x510 [ 22.055293] shrink_dcache_parent+0x190/0x240 [ 22.055703] do_one_tree+0x11/0x40 [ 22.056028] shrink_dcache_for_umount+0x61/0x140 [ 22.056461] generic_shutdown_super+0x70/0x590 [ 22.056879] kill_anon_super+0x3a/0x60 [ 22.057234] rpc_kill_sb+0x121/0x200
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-kvmUpgrade kernel-cross-headersUpgrade kernel-debug-coreUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perfUpgrade perfUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-debug-modulesUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade kernel-rt-develUpgrade kernel-rt-modulesUpgrade bpftoolUpgrade kernel-rt-coreUpgrade kernel-debugUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debugUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-debug-kvmUpgrade kernel-headersUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-extraUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-debug-develUpgrade kernel-zfcpdump-coreUpgrade kernel-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-develUpgrade kernel-docUpgrade kernel-zfcpdump-modulesUpgrade kernel-abi-stablelists | Aug 12, 2024 | May 21, 2024 |
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-livepatch-5.10.205-195.804Upgrade python-perfUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-livepatch-4.14.349-266.564Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.145-95.156Upgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade kernel-tools-devel | Jun 26, 2024 | May 21, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade perf-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-livepatch-6.1.66-91.160Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade perfUpgrade kernel-develUpgrade bpftoolUpgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-debuginfoUpgrade python3-perf | Feb 17, 2025 | May 21, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelists | Oct 8, 2024 | May 21, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade python3-perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-tools-libs | Oct 8, 2024 | May 21, 2024 |
| Oracle_linux | — | Upgrade kernelUpgrade kernel-uek | Aug 16, 2024 | May 21, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Aug 12, 2024 | May 21, 2024 |
| Rocky_linux | — | Upgrade perf-debuginfoUpgrade kernel-rt-debug-kvmUpgrade perfUpgrade kernel-rt-debug-develUpgrade kernel-headersUpgrade kernel-rt-modulesUpgrade kernel-tools-libs-develUpgrade kernel-rtUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-rt-debug-modulesUpgrade kernel-develUpgrade kernel-rt-modules-extraUpgrade kernel-debugUpgrade bpftoolUpgrade kernel-rt-debugUpgrade kernel-rt-kvmUpgrade kernel-rt-develUpgrade kernel-debuginfoUpgrade kernel-cross-headersUpgrade bpftool-debuginfoUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-rt-debuginfoUpgrade kernel-rt-coreUpgrade kernelUpgrade kernel-tools-debuginfoUpgrade kernel-debug-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-debug-debuginfoUpgrade kernel-coreUpgrade kernel-debug-coreUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-modulesUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-develUpgrade kernel-tools-libs | Aug 22, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-debug-livepatch-develUpgrade dlm-kmp-rtUpgrade dtb-apmUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade kernel-rt-optionalUpgrade kernel-obs-buildUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-defaultUpgrade kernel-azure-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-hisiliconUpgrade dtb-marvellUpgrade kernel-macrosUpgrade dtb-nvidiaUpgrade reiserfs-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-source-rtUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-kvmsmallUpgrade kernel-debug-develUpgrade dlm-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-azure-vdsoUpgrade kernel-azure-extraUpgrade kernel-rt-vdsoUpgrade dtb-appleUpgrade kernel-default-livepatch-develUpgrade kernel-azure-develUpgrade ocfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-default-livepatchUpgrade kernel-default-manUpgrade dtb-amdUpgrade kernel-syms-rtUpgrade dtb-renesasUpgrade dtb-broadcomUpgrade kernel-64kb-optionalUpgrade kernel-docsUpgrade kernel-docs-htmlUpgrade dtb-amlogicUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-defaultUpgrade dtb-sprdUpgrade kernel-rt_debugUpgrade kernel-azure-baseUpgrade ocfs2-kmp-rtUpgrade kernel-default-extraUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-rtUpgrade kernel-devel-rtUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade kernel-azureUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-azure-optionalUpgrade dtb-xilinxUpgrade kselftests-kmp-azureUpgrade dtb-allwinnerUpgrade dtb-lgUpgrade kernel-64kbUpgrade kernel-source-azureUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade gfs2-kmp-rtUpgrade dtb-alteraUpgrade kernel-sourceUpgrade kernel-default-develUpgrade gfs2-kmp-64kbUpgrade dtb-qcomUpgrade dtb-amazonUpgrade kernel-syms-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-devel-azureUpgrade kernel-default-optionalUpgrade gfs2-kmp-azureUpgrade dtb-rockchipUpgrade dtb-armUpgrade kernel-kvmsmall-develUpgrade kernel-debug-vdsoUpgrade dtb-exynosUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade gfs2-kmp-defaultUpgrade dtb-freescaleUpgrade kernel-source-vanillaUpgrade kernel-symsUpgrade dlm-kmp-64kbUpgrade dtb-caviumUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade kernel-64kb-develUpgrade dtb-mediatekUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-azure | Jun 12, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-gkeop-5.4Upgrade linux-image-5.4.0-1043-iotUpgrade linux-image-raspiUpgrade linux-image-oemUpgrade linux-image-5.4.0-1131-oracleUpgrade linux-image-awsUpgrade linux-image-5.4.0-1092-bluefieldUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-azureUpgrade linux-image-ibmUpgrade linux-image-aws-lts-20.04Upgrade linux-image-kvmUpgrade linux-image-5.4.0-1120-kvmUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-1099-gkeopUpgrade linux-image-5.4.0-1079-ibmUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-bluefieldUpgrade linux-image-virtualUpgrade linux-image-5.4.0-1137-azureUpgrade linux-image-gcpUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-genericUpgrade linux-image-5.4.0-195-lowlatencyUpgrade linux-image-5.4.0-195-genericUpgrade linux-image-5.4.0-1051-xilinx-zynqmpUpgrade linux-image-5.4.0-1132-awsUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-195-generic-lpaeUpgrade linux-image-raspi2Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-gkeopUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-generic-lpaeUpgrade linux-image-5.4.0-1136-gcpUpgrade linux-image-5.4.0-1116-raspiUpgrade linux-image-oracleUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oem-osp1Upgrade linux-image-raspi2-hwe-18.04 | Sep 13, 2024 | May 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub