In the Linux kernel, the following vulnerability has been resolved:
raid1: fix use-after-free for original bio in raid1_write_request()
r1_bio->bios[] is used to record new bios that will be issued to underlying disks, however, in raid1_write_request(), r1_bio->bios[] will set to the original bio temporarily. Meanwhile, if blocked rdev is set, free_r1bio() will be called causing that all r1_bio->bios[] to be freed:
raid1_write_request() r1_bio = alloc_r1bio(mddev, bio); -> r1_bio->bios[] is NULL for (i = 0; i < disks; i++) -> for each rdev in conf // first rdev is normal r1_bio->bios[0] = bio; -> set to original bio // second rdev is blocked if (test_bit(Blocked, &rdev->flags)) break
if (blocked_rdev) free_r1bio() put_all_bios() bio_put(r1_bio->bios[0]) -> original bio is freed
Test scripts:
mdadm -CR /dev/md0 -l1 -n4 /dev/sd[abcd] --assume-clean fio -filename=/dev/md0 -ioengine=libaio -rw=write -bs=4k -numjobs=1 \ -iodepth=128 -name=test -direct=1 echo blocked > /sys/block/md0/md/rd2/state
Test result:
BUG bio-264 (Not tainted): Object already free -----------------------------------------------------------------------------
Allocated in mempool_alloc_slab+0x24/0x50 age=1 cpu=1 pid=869 kmem_cache_alloc+0x324/0x480 mempool_alloc_slab+0x24/0x50 mempool_alloc+0x6e/0x220 bio_alloc_bioset+0x1af/0x4d0 blkdev_direct_IO+0x164/0x8a0 blkdev_write_iter+0x309/0x440 aio_write+0x139/0x2f0 io_submit_one+0x5ca/0xb70 __do_sys_io_submit+0x86/0x270 __x64_sys_io_submit+0x22/0x30 do_syscall_64+0xb1/0x210 entry_SYSCALL_64_after_hwframe+0x6c/0x74 Freed in mempool_free_slab+0x1f/0x30 age=1 cpu=1 pid=869 kmem_cache_free+0x28c/0x550 mempool_free_slab+0x1f/0x30 mempool_free+0x40/0x100 bio_free+0x59/0x80 bio_put+0xf0/0x220 free_r1bio+0x74/0xb0 raid1_make_request+0xadf/0x1150 md_handle_request+0xc7/0x3b0 md_submit_bio+0x76/0x130 __submit_bio+0xd8/0x1d0 submit_bio_noacct_nocheck+0x1eb/0x5c0 submit_bio_noacct+0x169/0xd40 submit_bio+0xee/0x1d0 blkdev_direct_IO+0x322/0x8a0 blkdev_write_iter+0x309/0x440 aio_write+0x139/0x2f0
Since that bios for underlying disks are not allocated yet, fix this problem by using mempool_free() directly to free the r1_bio.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Dec 5, 2024 | May 20, 2024 |
| Suse | — | Upgrade kernel-rt_debug-develUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade kernel-azure-baseUpgrade kernel-rt-optionalUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-default-develUpgrade kernel-sourceUpgrade kernel-rt-livepatch-develUpgrade dtb-hisiliconUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-baseUpgrade kernel-kvmsmall-develUpgrade kernel-source-rtUpgrade dtb-renesasUpgrade reiserfs-kmp-64kbUpgrade dtb-alteraUpgrade dtb-lgUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade dlm-kmp-defaultUpgrade kernel-zfcpdumpUpgrade dtb-appleUpgrade dtb-exynosUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-obs-buildUpgrade reiserfs-kmp-rtUpgrade kernel-debug-livepatch-develUpgrade dtb-amazonUpgrade kernel-azure-livepatch-develUpgrade kernel-default-livepatchUpgrade dtb-caviumUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-azureUpgrade dtb-amdUpgrade dtb-broadcomUpgrade dtb-freescaleUpgrade gfs2-kmp-azureUpgrade kernel-default-livepatch-develUpgrade kernel-debug-develUpgrade kernel-syms-rtUpgrade kernel-rt-extraUpgrade dtb-amlogicUpgrade kernel-source-vanillaUpgrade dtb-marvellUpgrade kernel-source-azureUpgrade kernel-rt-vdsoUpgrade kernel-default-manUpgrade kernel-azureUpgrade kernel-azure-develUpgrade kernel-docs-htmlUpgrade kernel-rt_debugUpgrade kernel-64kbUpgrade dtb-socionextUpgrade kernel-64kb-optionalUpgrade kernel-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-default-extraUpgrade kselftests-kmp-defaultUpgrade kernel-symsUpgrade dtb-rockchipUpgrade dtb-mediatekUpgrade dtb-allwinnerUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-default-optionalUpgrade kernel-default-base-rebuildUpgrade dtb-armUpgrade dtb-nvidiaUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-rt-livepatchUpgrade kernel-rtUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-rt-develUpgrade kernel-kvmsmallUpgrade kernel-default-vdsoUpgrade dtb-sprdUpgrade kernel-macrosUpgrade kernel-docsUpgrade dtb-qcomUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-rtUpgrade dtb-apmUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-develUpgrade dtb-xilinx | Jul 10, 2024 | May 20, 2024 |
| Ubuntu | — | Upgrade linux-image-gkeUpgrade linux-image-genericUpgrade linux-image-intelUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-oracle-64kUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-oem-24.04Upgrade linux-image-oracleUpgrade linux-image-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1008-oemUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-azureUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibmUpgrade linux-image-awsUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1011-awsUpgrade linux-image-azure-fde | Jul 12, 2024 | May 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub