In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: fix reference counting on zcrypt card objects
Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the struct zcrypt_card. The reason was an incorrect reference handling of the zcrypt card object which could lead to a free of the zcrypt card object while it was still in use.
This is an example of the slab message:
kernel: 0x00000000885a7512-0x00000000885a7513 @offset=1298. First byte 0x68 instead of 0x6b kernel: Allocated in zcrypt_card_alloc+0x36/0x70 [zcrypt] age=18046 cpu=3 pid=43 kernel: kmalloc_trace+0x3f2/0x470 kernel: zcrypt_card_alloc+0x36/0x70 [zcrypt] kernel: zcrypt_cex4_card_probe+0x26/0x380 [zcrypt_cex4] kernel: ap_device_probe+0x15c/0x290 kernel: really_probe+0xd2/0x468 kernel: driver_probe_device+0x40/0xf0 kernel: __device_attach_driver+0xc0/0x140 kernel: bus_for_each_drv+0x8c/0xd0 kernel: __device_attach+0x114/0x198 kernel: bus_probe_device+0xb4/0xc8 kernel: device_add+0x4d2/0x6e0 kernel: ap_scan_adapter+0x3d0/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: Freed in zcrypt_card_put+0x54/0x80 [zcrypt] age=9024 cpu=3 pid=43 kernel: kfree+0x37e/0x418 kernel: zcrypt_card_put+0x54/0x80 [zcrypt] kernel: ap_device_remove+0x4c/0xe0 kernel: device_release_driver_internal+0x1c4/0x270 kernel: bus_remove_device+0x100/0x188 kernel: device_del+0x164/0x3c0 kernel: device_unregister+0x30/0x90 kernel: ap_scan_adapter+0xc8/0x7c0 kernel: ap_scan_bus+0x5a/0x3b0 kernel: ap_scan_bus_wq_callback+0x40/0x60 kernel: process_one_work+0x26e/0x620 kernel: worker_thread+0x21c/0x440 kernel: kthread+0x150/0x168 kernel: __ret_from_fork+0x3c/0x58 kernel: ret_from_fork+0xa/0x30 kernel: Slab 0x00000372022169c0 objects=20 used=18 fp=0x00000000885a7c88 flags=0x3ffff00000000a00(workingset|slab|node=0|zone=1|lastcpupid=0x1ffff) kernel: Object 0x00000000885a74b8 @offset=1208 fp=0x00000000885a7c88 kernel: Redzone 00000000885a74b0: bb bb bb bb bb bb bb bb ........ kernel: Object 00000000885a74b8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74c8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74d8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74e8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a74f8: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk kernel: Object 00000000885a7508: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 68 4b 6b 6b 6b a5 kkkkkkkkkkhKkkk. kernel: Redzone 00000000885a7518: bb bb bb bb bb bb bb bb ........ kernel: Padding 00000000885a756c: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ kernel: CPU: 0 PID: 387 Comm: systemd-udevd Not tainted 6.8.0-HF #2 kernel: Hardware name: IBM 3931 A01 704 (KVM/Linux) kernel: Call Trace: kernel: [<00000000ca5ab5b8>] dump_stack_lvl+0x90/0x120 kernel: [<00000000c99d78bc>] check_bytes_and_report+0x114/0x140 kernel: [<00000000c99d53cc>] check_object+0x334/0x3f8 kernel: [<00000000c99d820c>] alloc_debug_processing+0xc4/0x1f8 kernel: [<00000000c99d852e>] get_partial_node.part.0+0x1ee/0x3e0 kernel: [<00000000c99d94ec>] ___slab_alloc+0xaf4/0x13c8 kernel: [<00000000c99d9e38>] __slab_alloc.constprop.0+0x78/0xb8 kernel: [<00000000c99dc8dc>] __kmalloc+0x434/0x590 kernel: [<00000000c9b4c0ce>] ext4_htree_store_dirent+0x4e/0x1c0 kernel: [<00000000c9b908a2>] htree_dirblock_to_tree+0x17a/0x3f0 kernel: ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Suse | — | Upgrade kernel-syms-azureUpgrade kselftests-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-rt-develUpgrade kernel-azure-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-sourceUpgrade kernel-symsUpgrade dtb-nvidiaUpgrade kernel-default-base-rebuildUpgrade kernel-rtUpgrade ocfs2-kmp-azureUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade dtb-caviumUpgrade gfs2-kmp-azureUpgrade kernel-64kb-develUpgrade dtb-sprdUpgrade dtb-apmUpgrade kernel-obs-qaUpgrade kernel-rt-livepatchUpgrade dtb-exynosUpgrade kernel-docsUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-rtUpgrade kernel-devel-azureUpgrade dtb-armUpgrade cluster-md-kmp-64kbUpgrade kernel-defaultUpgrade kernel-default-optionalUpgrade kernel-64kb-extraUpgrade dtb-xilinxUpgrade dtb-rockchipUpgrade kernel-develUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade kernel-devel-rtUpgrade dtb-allwinnerUpgrade kernel-azure-develUpgrade kernel-default-extraUpgrade dtb-mediatekUpgrade dlm-kmp-azureUpgrade kernel-64kbUpgrade kernel-azureUpgrade kernel-debugUpgrade kernel-azure-baseUpgrade dtb-hisiliconUpgrade dtb-appleUpgrade dtb-amazonUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-kvmsmallUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-renesasUpgrade dtb-broadcomUpgrade kernel-syms-rtUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade kernel-default-baseUpgrade kernel-rt-optionalUpgrade dlm-kmp-64kbUpgrade kernel-zfcpdumpUpgrade kernel-default-develUpgrade dtb-alteraUpgrade kernel-azure-vdsoUpgrade kernel-rt_debugUpgrade kernel-rt-vdsoUpgrade kselftests-kmp-azureUpgrade kernel-default-manUpgrade gfs2-kmp-rtUpgrade dlm-kmp-defaultUpgrade dtb-lgUpgrade reiserfs-kmp-64kbUpgrade cluster-md-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-debug-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-vdsoUpgrade dtb-amlogicUpgrade dtb-amdUpgrade kernel-rt_debug-develUpgrade kernel-source-azureUpgrade kernel-macrosUpgrade dtb-socionextUpgrade kernel-kvmsmall-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade dtb-freescaleUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-azure-extraUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade dtb-marvellUpgrade kernel-source-rtUpgrade kernel-default-livepatch-devel | Jun 12, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-intel-iotgUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-5.4.0-1133-azureUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-genericUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-5.4.0-1127-oracleUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-gkeopUpgrade linux-image-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-oem-20.04bUpgrade linux-image-intelUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-gkeop-5.4Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-oem-20.04cUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1088-bluefieldUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-raspi2Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-oem-20.04Upgrade linux-image-oem-24.04aUpgrade linux-image-bluefieldUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-virtualUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-oem-20.04dUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-116-genericUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-osp1Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.4.0-1047-xilinx-zynqmpUpgrade linux-image-5.4.0-189-generic-lpaeUpgrade linux-image-5.4.0-1075-ibmUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-6.8.0-1008-azureUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-ibm-classicUpgrade linux-image-awsUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-raspiUpgrade linux-image-oemUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-kvmUpgrade linux-image-5.4.0-1116-kvmUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-gke-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-5.4.0-1128-awsUpgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-azure-cvmUpgrade linux-image-5.4.0-1095-gkeopUpgrade linux-image-5.4.0-1132-gcpUpgrade linux-image-azureUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-5.4.0-189-genericUpgrade linux-image-aws-lts-20.04Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-5.4.0-1040-iotUpgrade linux-image-5.4.0-189-lowlatencyUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.4.0-1112-raspiUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.8.0-35-lowlatency | Jul 1, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub