In the Linux kernel, the following vulnerability has been resolved:
bootconfig: use memblock_free_late to free xbc memory to buddy
On the time to free xbc memory in xbc_exit(), memblock may has handed over memory to buddy allocator. So it doesn't make sense to free memory back to memblock. memblock_free() called by xbc_exit() even causes UAF bugs on architectures with CONFIG_ARCH_KEEP_MEMBLOCK disabled like x86. Following KASAN logs shows this case.
This patch fixes the xbc memory free problem by calling memblock_free() in early xbc init error rewind path and calling memblock_free_late() in xbc exit path to free memory to buddy allocator.
[ 9.410890] ================================================================== [ 9.418962] BUG: KASAN: use-after-free in memblock_isolate_range+0x12d/0x260 [ 9.426850] Read of size 8 at addr ffff88845dd30000 by task swapper/0/1
[ 9.435901] CPU: 9 PID: 1 Comm: swapper/0 Tainted: G U 6.9.0-rc3-00208-g586b5dfb51b9 #5 [ 9.446403] Hardware name: Intel Corporation RPLP LP5 (CPU:RaptorLake)/RPLP LP5 (ID:13), BIOS IRPPN02.01.01.00.00.19.015.D-00000000 Dec 28 2023 [ 9.460789] Call Trace: [ 9.463518] <TASK> [ 9.465859] dump_stack_lvl+0x53/0x70 [ 9.469949] print_report+0xce/0x610 [ 9.473944] ? __virt_addr_valid+0xf5/0x1b0 [ 9.478619] ? memblock_isolate_range+0x12d/0x260 [ 9.483877] kasan_report+0xc6/0x100 [ 9.487870] ? memblock_isolate_range+0x12d/0x260 [ 9.493125] memblock_isolate_range+0x12d/0x260 [ 9.498187] memblock_phys_free+0xb4/0x160 [ 9.502762] ? __pfx_memblock_phys_free+0x10/0x10 [ 9.508021] ? mutex_unlock+0x7e/0xd0 [ 9.512111] ? __pfx_mutex_unlock+0x10/0x10 [ 9.516786] ? kernel_init_freeable+0x2d4/0x430 [ 9.521850] ? __pfx_kernel_init+0x10/0x10 [ 9.526426] xbc_exit+0x17/0x70 [ 9.529935] kernel_init+0x38/0x1e0 [ 9.533829] ? _raw_spin_unlock_irq+0xd/0x30 [ 9.538601] ret_from_fork+0x2c/0x50 [ 9.542596] ? __pfx_kernel_init+0x10/0x10 [ 9.547170] ret_from_fork_asm+0x1a/0x30 [ 9.551552] </TASK>
[ 9.555649] The buggy address belongs to the physical page: [ 9.561875] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x45dd30 [ 9.570821] flags: 0x200000000000000(node=0|zone=2) [ 9.576271] page_type: 0xffffffff() [ 9.580167] raw: 0200000000000000 ffffea0011774c48 ffffea0012ba1848 0000000000000000 [ 9.588823] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 9.597476] page dumped because: kasan: bad access detected
[ 9.605362] Memory state around the buggy address: [ 9.610714] ffff88845dd2ff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.618786] ffff88845dd2ff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 9.626857] >ffff88845dd30000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.634930] ^ [ 9.638534] ffff88845dd30080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.646605] ffff88845dd30100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 9.654675] ==================================================================
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-modules-extra-commonUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-6.1.90-99.173Upgrade kernel-libbpf-staticUpgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-modules-extraUpgrade bpftool | Feb 17, 2025 | May 1, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | May 1, 2024 |
| Suse | — | Upgrade dtb-sprdUpgrade kernel-default-optionalUpgrade reiserfs-kmp-rtUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-64kbUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-azureUpgrade kernel-64kb-livepatch-develUpgrade dtb-xilinxUpgrade kernel-default-livepatch-develUpgrade cluster-md-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-develUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-extraUpgrade gfs2-kmp-64kbUpgrade dtb-amazonUpgrade dtb-appleUpgrade dtb-mediatekUpgrade kernel-64kbUpgrade cluster-md-kmp-64kbUpgrade dlm-kmp-rtUpgrade kernel-64kb-develUpgrade kernel-default-develUpgrade reiserfs-kmp-defaultUpgrade dtb-amdUpgrade kernel-default-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-rt-develUpgrade ocfs2-kmp-defaultUpgrade dtb-allwinnerUpgrade dtb-armUpgrade kernel-debug-develUpgrade dtb-caviumUpgrade kernel-debugUpgrade dtb-renesasUpgrade kernel-azure-optionalUpgrade kernel-devel-rtUpgrade ocfs2-kmp-azureUpgrade kernel-default-baseUpgrade dtb-alteraUpgrade kernel-defaultUpgrade kernel-symsUpgrade kernel-64kb-optionalUpgrade kernel-azure-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azureUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-sourceUpgrade cluster-md-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-default-base-rebuildUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-source-rtUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-develUpgrade kernel-obs-qaUpgrade kernel-rt_debug-develUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-vdsoUpgrade dtb-broadcomUpgrade dtb-qcomUpgrade dtb-exynosUpgrade kernel-azure-extraUpgrade kernel-rt-vdsoUpgrade dtb-apmUpgrade ocfs2-kmp-rtUpgrade kernel-syms-azureUpgrade kernel-rt-extraUpgrade kernel-azure-develUpgrade dtb-socionextUpgrade dtb-marvellUpgrade kernel-source-azureUpgrade kernel-docs-htmlUpgrade kernel-devel-azureUpgrade ocfs2-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade kernel-rt_debugUpgrade dtb-amlogicUpgrade kernel-zfcpdumpUpgrade kernel-default-livepatchUpgrade kernel-debug-vdsoUpgrade kernel-obs-buildUpgrade dtb-lgUpgrade kernel-docsUpgrade dlm-kmp-azureUpgrade dtb-rockchipUpgrade dtb-nvidiaUpgrade kernel-macrosUpgrade dtb-freescale | Jun 24, 2024 | May 1, 2024 |
| Ubuntu | — | Upgrade linux-image-intelUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-raspiUpgrade linux-image-nvidia-64kUpgrade linux-image-azureUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-awsUpgrade linux-image-gkeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-genericUpgrade linux-image-oracleUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-ibmUpgrade linux-image-gcpUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-6.8.0-1008-oracle-64k | Jul 12, 2024 | May 1, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub