In the Linux kernel, the following vulnerability has been resolved:
bootconfig: use memblock_free_late to free xbc memory to buddy
On the time to free xbc memory in xbc_exit(), memblock may has handed over memory to buddy allocator. So it doesn't make sense to free memory back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86. Following KASAN logs shows this case.
This patch fixes the xbc memory free problem by calling memblock_free() in early xbc init error rewind path and calling memblock_free_late() in xbc exit path to free memory to buddy allocator.
[ 9.410890] ================================================================== [ 9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260 [ 9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1
[ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G U 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023 [ 9.460789] Call Trace: [ 9.463518] <TASK> [ 9.465859] dump_stack_lvl+0x53/0x70 [ 9.469949] print_report+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [ 9.478619] ? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [ 9.493125] memblock_isolate_range+0x12d/0x260 [ 9.498187] memblock_phys_free+0xb4/0x160 [ 9.502762] ? __pfx_memblock_phys_free+0x10/0x10 [ 9.508021] ? mutex_unlock+0x7e/0xd0 [ 9.512111] ? __pfx_mutex_unlock+0x10/0x10 [ 9.516786] ? kernel_init_freeable+0x2d4/0x430 [ 9.521850] ? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [ 9.538601] ret_from_fork+0x2c/0x50 [ 9.542596] ? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552] </TASK>
[ 9.555649] The buggy address belongs to the physical page: [ 9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30 [ 9.570821] flags: 0x200000000000000(node=0|zone=2) [ 9.576271] page_type: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000 [ 9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 9.597476] page dumped because: kasan: bad access detected
[ 9.605362] Memory state around the buggy address: [ 9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] >ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ==================================================================
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade python3-perf-debuginfoUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade python3-perfUpgrade kernel-debuginfoUpgrade kernel-develUpgrade bpftoolUpgrade kernel-modules-extraUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade kernel-toolsUpgrade kernel-libbpf-staticUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-6.1.90-99.173Upgrade kernelUpgrade kernel-libbpf-develUpgrade bpftool-debuginfo | Feb 17, 2025 | May 1, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Suse | — | Upgrade kernel-source-azureUpgrade dtb-marvellUpgrade kernel-devel-azureUpgrade dtb-socionextUpgrade kernel-azure-develUpgrade kernel-docs-htmlUpgrade kernel-rt-extraUpgrade kernel-kvmsmall-develUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade dtb-exynosUpgrade kernel-azure-extraUpgrade kselftests-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-sourceUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-azure-vdsoUpgrade kernel-default-base-rebuildUpgrade kernel-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade dtb-qcomUpgrade kernel-obs-qaUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-syms-azureUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade dtb-apmUpgrade kernel-rt-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-rtUpgrade dtb-freescaleUpgrade kernel-docsUpgrade dtb-lgUpgrade kernel-syms-rtUpgrade dtb-broadcomUpgrade kernel-azureUpgrade kernel-source-vanillaUpgrade kernel-default-extraUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kselftests-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-zfcpdumpUpgrade kernel-debug-vdsoUpgrade dtb-amlogicUpgrade kernel-default-livepatchUpgrade dtb-nvidiaUpgrade dtb-rockchipUpgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade dlm-kmp-64kbUpgrade dtb-armUpgrade reiserfs-kmp-defaultUpgrade dtb-caviumUpgrade dtb-renesasUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade kernel-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade dtb-amdUpgrade dtb-allwinnerUpgrade dtb-hisiliconUpgrade cluster-md-kmp-rtUpgrade kernel-64kbUpgrade gfs2-kmp-azureUpgrade dtb-xilinxUpgrade kernel-debugUpgrade kernel-64kb-optionalUpgrade kernel-symsUpgrade kernel-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-default-develUpgrade kernel-64kb-develUpgrade kernel-azure-optionalUpgrade kernel-default-baseUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-devel-rtUpgrade dlm-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade kernel-debug-develUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-azureUpgrade kernel-64kb-extraUpgrade dtb-appleUpgrade dtb-amazonUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade kselftests-kmp-rtUpgrade dtb-sprdUpgrade dtb-alteraUpgrade kernel-default-optionalUpgrade kernel-rt-develUpgrade kernel-default-vdso | Jun 24, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-nvidia-64kUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-kvmUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-intelUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-azureUpgrade linux-image-azure-fdeUpgrade linux-image-awsUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-gkeUpgrade linux-image-nvidiaUpgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-genericUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-oem-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-ibmUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1007-raspi | Jul 12, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub