In the Linux kernel, the following vulnerability has been resolved:
bootconfig: use memblock_free_late to free xbc memory to buddy
On the time to free xbc memory in xbc_exit(), memblock may has handed over memory to buddy allocator. So it doesn't make sense to free memory back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86. Following KASAN logs shows this case.
This patch fixes the xbc memory free problem by calling memblock_free() in early xbc init error rewind path and calling memblock_free_late() in xbc exit path to free memory to buddy allocator.
[ 9.410890] ================================================================== [ 9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260 [ 9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1
[ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G U 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023 [ 9.460789] Call Trace: [ 9.463518] <TASK> [ 9.465859] dump_stack_lvl+0x53/0x70 [ 9.469949] print_report+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [ 9.478619] ? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [ 9.493125] memblock_isolate_range+0x12d/0x260 [ 9.498187] memblock_phys_free+0xb4/0x160 [ 9.502762] ? __pfx_memblock_phys_free+0x10/0x10 [ 9.508021] ? mutex_unlock+0x7e/0xd0 [ 9.512111] ? __pfx_mutex_unlock+0x10/0x10 [ 9.516786] ? kernel_init_freeable+0x2d4/0x430 [ 9.521850] ? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [ 9.538601] ret_from_fork+0x2c/0x50 [ 9.542596] ? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552] </TASK>
[ 9.555649] The buggy address belongs to the physical page: [ 9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30 [ 9.570821] flags: 0x200000000000000(node=0|zone=2) [ 9.576271] page_type: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000 [ 9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 9.597476] page dumped because: kasan: bad access detected
[ 9.605362] Memory state around the buggy address: [ 9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] >ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ==================================================================
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade bpftoolUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-livepatch-6.1.90-99.173Upgrade kernel-modules-extra-commonUpgrade kernel-libbpf-develUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-tools | Feb 17, 2025 | May 1, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Suse | — | Upgrade kernel-rt-develUpgrade dlm-kmp-64kbUpgrade kernel-debugUpgrade kernel-defaultUpgrade dtb-amazonUpgrade kernel-debug-develUpgrade dtb-xilinxUpgrade gfs2-kmp-azureUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-default-optionalUpgrade kselftests-kmp-rtUpgrade dtb-sprdUpgrade cluster-md-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-64kb-optionalUpgrade dtb-allwinnerUpgrade kernel-devel-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-default-baseUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-develUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-extraUpgrade dtb-appleUpgrade dtb-mediatekUpgrade gfs2-kmp-64kbUpgrade kernel-default-develUpgrade kernel-develUpgrade dtb-alteraUpgrade dtb-amdUpgrade dtb-caviumUpgrade dtb-armUpgrade dtb-renesasUpgrade kernel-azure-optionalUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-obs-qaUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-azure-extraUpgrade dtb-lgUpgrade kernel-azureUpgrade gfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-obs-buildUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docsUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-defaultUpgrade dtb-amlogicUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-rt-vdsoUpgrade dtb-apmUpgrade cluster-md-kmp-azureUpgrade dtb-qcomUpgrade dtb-exynosUpgrade dtb-broadcomUpgrade kernel-source-rtUpgrade kernel-rt_debug-develUpgrade kernel-rt-optionalUpgrade kselftests-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade kernel-macrosUpgrade kernel-rt_debugUpgrade kernel-rt-extraUpgrade kernel-docs-htmlUpgrade kernel-devel-azureUpgrade kernel-azure-develUpgrade dtb-socionextUpgrade dtb-marvellUpgrade kernel-source-azureUpgrade kernel-zfcpdumpUpgrade kernel-debug-vdsoUpgrade kernel-azure-livepatch-develUpgrade kernel-default-livepatchUpgrade kselftests-kmp-azureUpgrade kernel-source-vanillaUpgrade kernel-sourceUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade dtb-freescale | Jun 24, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-gcpUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-awsUpgrade linux-image-nvidiaUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-virtualUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-genericUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-oem-24.04aUpgrade linux-image-intelUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-azure-fdeUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-kvmUpgrade linux-image-azure | Jul 12, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub