In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818
Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257
Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818
[Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Nov 11, 2024 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade kernel-tools-libs | Jan 14, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Feb 11, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftoolUpgrade python3-perfUpgrade kernel | Feb 11, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernelUpgrade python3-perf | Jan 15, 2025 | Oct 29, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | May 15, 2025 | Oct 29, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1031-nvidia-tegra-igxUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-4.4.0-271-lowlatencyUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-6.8.0-57-genericUpgrade linux-image-azure-lts-18.04Upgrade linux-image-4.15.0-1176-gcpUpgrade linux-image-ibm-5.15Upgrade linux-image-kvm-5.15Upgrade linux-image-5.15.0-1083-raspiUpgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-aws-5.15Upgrade linux-image-6.8.0-1024-nvidia-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-snapdragon-5.4Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1026-gcp-64kUpgrade linux-image-oemUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-virtualUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-realtime-5.15Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-5.4.0-1123-fipsUpgrade linux-image-generic-lpae-5.4Upgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-5.15.0-1042-nvidia-tegraUpgrade linux-image-generic-lpaeUpgrade linux-image-kvm-5.4Upgrade linux-image-6.8.0-1024-nvidia-lowlatencyUpgrade linux-image-oracleUpgrade linux-image-azure-fips-5.15Upgrade linux-image-nvidia-5.15Upgrade linux-image-gkeop-5.15Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-genericUpgrade linux-image-azure-4.15Upgrade linux-image-5.15.0-1088-gcp-fipsUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1027-awsUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-5.15.0-1086-gkeUpgrade linux-image-6.8.0-1025-awsUpgrade linux-image-gkeUpgrade linux-image-oem-24.04bUpgrade linux-image-fipsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-aws-lts-18.04Upgrade linux-image-6.11.0-18-genericUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1094-azure-fipsUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-6.8.0-1024-nvidiaUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1071-gkeopUpgrade linux-image-5.15.0-1089-aws-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-osp1Upgrade linux-image-4.15.0-2100-azure-fipsUpgrade linux-image-azure-lts-20.04Upgrade linux-image-4.15.0-2121-aws-fipsUpgrade linux-image-gkeopUpgrade linux-image-nvidia-tegraUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-6.11.0-1015-oemUpgrade linux-image-lowlatency-5.4Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-5.15.0-1081-ibmUpgrade linux-image-6.8.0-1008-gkeopUpgrade linux-image-5.15.0-1085-kvmUpgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-145-lowlatencyUpgrade linux-image-5.15.0-1088-gcpUpgrade linux-image-5.4.0-1148-oracleUpgrade linux-image-5.15.0-1089-awsUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-56-lowlatencyUpgrade linux-image-4.15.0-240-genericUpgrade linux-image-5.15.0-1094-azureUpgrade linux-image-4.15.0-2084-gcp-fipsUpgrade linux-image-5.15.0-1031-nvidia-tegra-igx-rtUpgrade linux-image-intelUpgrade linux-image-nvidiaUpgrade linux-image-5.4.0-1108-bluefieldUpgrade linux-image-raspi-5.15Upgrade linux-image-4.4.0-1147-kvmUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-lts-xenialUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-20.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-5.4.0-1132-raspiUpgrade linux-image-lowlatency-5.15Upgrade linux-image-4.15.0-1183-awsUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-5.4.0-220-lowlatencyUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1084-intel-iotgUpgrade linux-image-gcp-4.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-xilinx-zynqmp-5.4Upgrade linux-image-nvidia-6.8Upgrade linux-image-5.4.0-1152-gcpUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-5.4.0-1154-azureUpgrade linux-image-4.15.0-1166-kvmUpgrade linux-image-5.4.0-1067-xilinx-zynqmpUpgrade linux-image-5.4.0-1155-azure-fipsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-fips-5.15Upgrade linux-image-6.8.0-1024-nvidia-lowlatency-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-bluefieldUpgrade linux-image-oracle-4.15Upgrade linux-image-raspi-realtimeUpgrade linux-image-oem-20.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-22.04Upgrade linux-image-5.4.0-220-genericUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.15.0-151-generic-64kUpgrade linux-image-4.4.0-1116-fipsUpgrade linux-image-6.8.0-1024-oemUpgrade linux-image-5.4.0-1147-oracleUpgrade linux-image-gcpUpgrade linux-image-aws-4.15Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-6.8.0-1022-oracleUpgrade linux-image-4.15.0-1191-azureUpgrade linux-image-5.15.0-1042-nvidia-tegra-rtUpgrade linux-image-azure-fipsUpgrade linux-image-4.4.0-1146-awsUpgrade linux-image-oracle-5.4Upgrade linux-image-awsUpgrade linux-image-5.4.0-1136-kvmUpgrade linux-image-6.8.0-56-genericUpgrade linux-image-5.15.0-1083-nvidiaUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-fips-5.4Upgrade linux-image-aws-64k-5.15Upgrade linux-image-oem-22.04aUpgrade linux-image-5.4.0-1149-aws-fipsUpgrade linux-image-oracle-5.15Upgrade linux-image-4.4.0-1184-awsUpgrade linux-image-gke-5.15Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-aws-lts-20.04Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-fips-5.4Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-151-genericUpgrade linux-image-5.4.0-220-generic-lpaeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-5.4.0-1152-gcp-fipsUpgrade linux-image-6.8.0-56-generic-64kUpgrade linux-image-5.15.0-1089-realtimeUpgrade linux-image-5.15.0-1082-intel-iot-realtimeUpgrade linux-image-generic-64k-5.15Upgrade linux-image-bluefield-5.4Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-6.11.0-1009-azureUpgrade linux-image-5.4.0-1095-ibmUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oracle-lts-18.04Upgrade linux-image-gcp-fips-4.15Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-5.15.0-1089-aws-fipsUpgrade linux-image-gcp-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-151-generic-lpaeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-azure-5.15Upgrade linux-image-4.15.0-1145-oracleUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-aws-lts-22.04Upgrade linux-image-raspi-5.4Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-6.8.0-1025-azureUpgrade linux-image-6.8.0-56-lowlatency-64kUpgrade linux-image-azure-5.4Upgrade linux-image-5.4.0-1053-iotUpgrade linux-image-5.4.0-1149-awsUpgrade linux-image-4.15.0-240-lowlatencyUpgrade linux-image-4.4.0-271-genericUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-6.8.0-1026-gcpUpgrade linux-image-ibm-5.4Upgrade linux-image-azure-fips-4.15Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gcp-fipsUpgrade linux-image-generic-5.15Upgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-gcp-5.4Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-raspiUpgrade linux-image-aws-fips-4.15Upgrade linux-image-aws-fips-5.15Upgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-gcp-64kUpgrade linux-image-aws-lts-24.04Upgrade linux-image-5.15.0-145-fipsUpgrade linux-image-aws-fips-5.4Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-gcp-fips-5.4Upgrade linux-image-5.15.0-1053-xilinx-zynqmpUpgrade linux-image-azure-cvmUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-raspi2Upgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-6.8.1-1018-realtimeUpgrade linux-image-5.15.0-145-lowlatency-64kUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-aws-5.4Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-aws-hweUpgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-6.8.0-1021-gkeUpgrade linux-image-5.15.0-1083-nvidia-lowlatencyUpgrade linux-image-oem-22.04bUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-virtual-5.15Upgrade linux-image-6.11.0-1009-awsUpgrade linux-image-ibmUpgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-azureUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-5.4Upgrade linux-image-4.15.0-1138-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-virtual-5.4Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1022-oracle-64kUpgrade linux-image-5.15.0-1086-oracleUpgrade linux-image-ibm-classic | Feb 20, 2025 | Oct 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | Oct 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub