In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: fix reference counting on zcrypt card objects
Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use.
This is an example of the slab message:
kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 kernel: kmalloc_trace+0x3f2/0x470 kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] kernel: ap_device_probe+0x15c/0x290 kernel: really_probe+0xd2/0x468 kernel: driver_probe_device+0x40/0xf0 kernel: __device_attach_driver+0xc0/0x140 kernel: bus_for_each_drv+0x8c/0xd0 kernel: __device_attach+0x114/0x198 kernel: bus_probe_device+0xb4/0xc8 kernel: device_add+0x4d2/0x6e0 kernel: ap_scan_adapter+0x3d0/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 kernel: kfree+0x37e/0x418 kernel: zcrypt_card_put+0x54/0x80 [zcrypt] kernel: ap_device_remove+0x4c/0xe0 kernel: device_release_driver_internal+0x1c4/0x270 kernel: bus_remove_device+0x100/0x188 kernel: device_del+0x164/0x3c0 kernel: device_unregister+0x30/0x90 kernel: ap_scan_adapter+0xc8/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: kthread+0x150/0x168 kernel: __ret_from_fork+0x3c/0x58 kernel: ret_from_fork+0xa/0x30 kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) kernel: Call Trace: kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 kernel: ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Suse | — | Upgrade kernel-rt-optionalUpgrade kernel-default-baseUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-default-manUpgrade dtb-marvellUpgrade dlm-kmp-64kbUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade dtb-amdUpgrade dtb-hisiliconUpgrade kernel-source-vanillaUpgrade kselftests-kmp-azureUpgrade kernel-debug-develUpgrade dtb-lgUpgrade kernel-default-develUpgrade kernel-rt_debugUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-rtUpgrade kernel-macrosUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-develUpgrade kernel-source-azureUpgrade dtb-freescaleUpgrade kernel-rt-extraUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-extraUpgrade kernel-azure-baseUpgrade dtb-amazonUpgrade kselftests-kmp-rtUpgrade kernel-debug-vdsoUpgrade dtb-amlogicUpgrade reiserfs-kmp-defaultUpgrade dtb-socionextUpgrade kernel-default-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-alteraUpgrade kernel-64kb-livepatch-develUpgrade dtb-appleUpgrade kernel-source-rtUpgrade cluster-md-kmp-azureUpgrade dtb-renesasUpgrade reiserfs-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-syms-rtUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-64kbUpgrade kernel-azure-optionalUpgrade kernel-debugUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-buildUpgrade ocfs2-kmp-defaultUpgrade kernel-sourceUpgrade ocfs2-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-azure-livepatch-develUpgrade dtb-sprdUpgrade kernel-obs-qaUpgrade kernel-rt-livepatchUpgrade dtb-apmUpgrade dtb-mediatekUpgrade kselftests-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-rt-develUpgrade kernel-default-extraUpgrade kernel-devel-azureUpgrade kernel-docsUpgrade dtb-armUpgrade kernel-azure-develUpgrade kernel-develUpgrade kernel-default-optionalUpgrade dtb-exynosUpgrade ocfs2-kmp-azureUpgrade dtb-qcomUpgrade kernel-default-vdsoUpgrade dlm-kmp-rtUpgrade kernel-rtUpgrade kernel-symsUpgrade dtb-allwinnerUpgrade kernel-defaultUpgrade cluster-md-kmp-rtUpgrade dtb-xilinxUpgrade dtb-rockchipUpgrade kselftests-kmp-defaultUpgrade kernel-default-base-rebuildUpgrade dtb-caviumUpgrade kernel-64kb-develUpgrade kernel-devel-rtUpgrade gfs2-kmp-azureUpgrade dlm-kmp-azureUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-azureUpgrade cluster-md-kmp-64kb | Jun 12, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-gkeopUpgrade linux-image-raspi2Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-20.04bUpgrade linux-image-intelUpgrade linux-image-oem-20.04cUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-gkeUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1133-azureUpgrade linux-image-azure-lts-20.04Upgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-genericUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-gkeop-5.15Upgrade linux-image-oracle-64kUpgrade linux-image-oem-20.04dUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-oem-24.04aUpgrade linux-image-oem-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-oem-osp1Upgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-oem-24.04Upgrade linux-image-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-gkeop-5.4Upgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-nvidiaUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-intel-iotgUpgrade linux-image-bluefieldUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-oemUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-189-genericUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-aws-lts-20.04Upgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-raspiUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-lowlatencyUpgrade linux-image-ibm-classicUpgrade linux-image-ibmUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-azureUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-awsUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-azure-fdeUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1068-azureUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-5.4.0-189-lowlatency | Jul 1, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub