In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm: Fix use-after-free in gsm_cleanup_mux
BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 Call Trace: <TASK> gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] __pfx_gsm_cleanup_mux+0x10/0x10 drivers/tty/n_gsm.c:3124 [n_gsm] __pfx_sched_clock_cpu+0x10/0x10 kernel/sched/clock.c:389 update_load_avg+0x1c1/0x27b0 kernel/sched/fair.c:4500 __pfx_min_vruntime_cb_rotate+0x10/0x10 kernel/sched/fair.c:846 __rb_insert_augmented+0x492/0xbf0 lib/rbtree.c:161 gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] _raw_spin_lock_irqsave+0x92/0xf0 arch/x86/include/asm/atomic.h:107 __pfx_gsmld_ioctl+0x10/0x10 drivers/tty/n_gsm.c:3822 [n_gsm] ktime_get+0x5e/0x140 kernel/time/timekeeping.c:195 ldsem_down_read+0x94/0x4e0 arch/x86/include/asm/atomic64_64.h:79 __pfx_ldsem_down_read+0x10/0x10 drivers/tty/tty_ldsem.c:338 __pfx_do_vfs_ioctl+0x10/0x10 fs/ioctl.c:805 tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818
Allocated by task 65: gsm_data_alloc.constprop.0+0x27/0x190 drivers/tty/n_gsm.c:926 [n_gsm] gsm_send+0x2c/0x580 drivers/tty/n_gsm.c:819 [n_gsm] gsm1_receive+0x547/0xad0 drivers/tty/n_gsm.c:3038 [n_gsm] gsmld_receive_buf+0x176/0x280 drivers/tty/n_gsm.c:3609 [n_gsm] tty_ldisc_receive_buf+0x101/0x1e0 drivers/tty/tty_buffer.c:391 tty_port_default_receive_buf+0x61/0xa0 drivers/tty/tty_port.c:39 flush_to_ldisc+0x1b0/0x750 drivers/tty/tty_buffer.c:445 process_scheduled_works+0x2b0/0x10d0 kernel/workqueue.c:3229 worker_thread+0x3dc/0x950 kernel/workqueue.c:3391 kthread+0x2a3/0x370 kernel/kthread.c:389 ret_from_fork+0x2d/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:257
Freed by task 3367: kfree+0x126/0x420 mm/slub.c:4580 gsm_cleanup_mux+0x36c/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] gsmld_ioctl+0x395/0x1450 drivers/tty/n_gsm.c:3408 [n_gsm] tty_ioctl+0x643/0x1100 drivers/tty/tty_io.c:2818
[Analysis] gsm_msg on the tx_ctrl_list or tx_data_list of gsm_mux can be freed by multi threads through ioctl,which leads to the occurrence of uaf. Protect it by gsm tx lock.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Nov 11, 2024 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-tools | Jan 14, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelists | Feb 11, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Feb 11, 2025 | Oct 29, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel | Jan 15, 2025 | Oct 29, 2024 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | May 15, 2025 | Oct 29, 2024 |
| Ubuntu | — | Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-raspi-hwe-18.04Upgrade linux-image-6.11.0-1009-azure-fdeUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-generic-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-realtime-5.15Upgrade linux-image-5.15.0-1089-awsUpgrade linux-image-5.15.0-1081-ibmUpgrade linux-image-nvidia-5.15Upgrade linux-image-6.11.0-1015-oemUpgrade linux-image-5.15.0-1083-raspiUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1024-nvidia-64kUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-4.15.0-1176-gcpUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1026-gcp-64kUpgrade linux-image-lowlatency-5.4Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-azure-fips-5.15Upgrade linux-image-snapdragon-5.4Upgrade linux-image-5.15.0-1085-kvmUpgrade linux-image-5.4.0-1155-azure-fipsUpgrade linux-image-6.8.0-57-genericUpgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-ibm-5.15Upgrade linux-image-azure-lts-18.04Upgrade linux-image-generic-lpae-5.4Upgrade linux-image-5.15.0-1042-nvidia-tegraUpgrade linux-image-4.15.0-240-genericUpgrade linux-image-6.8.0-56-lowlatencyUpgrade linux-image-5.4.0-1132-raspiUpgrade linux-image-kvm-5.15Upgrade linux-image-oracleUpgrade linux-image-oem-20.04Upgrade linux-image-virtualUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1094-azureUpgrade linux-image-intelUpgrade linux-image-oemUpgrade linux-image-nvidia-tegraUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-azure-lts-20.04Upgrade linux-image-intel-iotgUpgrade linux-image-6.11.0-1010-lowlatencyUpgrade linux-image-5.15.0-1088-gcp-fipsUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-4.15.0-2100-azure-fipsUpgrade linux-image-oracle-64kUpgrade linux-image-4.15.0-2121-aws-fipsUpgrade linux-image-5.15.0-1089-aws-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-oem-osp1Upgrade linux-image-5.15.0-1071-gkeopUpgrade linux-image-6.8.0-1025-azure-fdeUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-aws-lts-18.04Upgrade linux-image-5.4.0-1154-azureUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-5.4.0-1123-fipsUpgrade linux-image-oem-24.04aUpgrade linux-image-oem-20.04bUpgrade linux-image-kvm-5.4Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-fipsUpgrade linux-image-fips-5.15Upgrade linux-image-6.8.0-1027-awsUpgrade linux-image-6.11.0-18-genericUpgrade linux-image-bluefieldUpgrade linux-image-6.8.0-1024-nvidiaUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.15.0-145-lowlatencyUpgrade linux-image-5.4.0-1148-oracleUpgrade linux-image-6.8.0-1008-gkeopUpgrade linux-image-5.15.0-1086-gkeUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-oem-20.04cUpgrade linux-image-oem-24.04bUpgrade linux-image-4.4.0-271-lowlatencyUpgrade linux-image-4.15.0-1183-awsUpgrade linux-image-raspi-5.15Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-6.8.0-1025-awsUpgrade linux-image-6.11.0-1009-gcpUpgrade linux-image-5.15.0-1031-nvidia-tegra-igxUpgrade linux-image-5.15.0-1088-gcpUpgrade linux-image-raspi-realtimeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1024-nvidia-lowlatencyUpgrade linux-image-oracle-4.15Upgrade linux-image-6.8.0-1024-oemUpgrade linux-image-5.4.0-1067-xilinx-zynqmpUpgrade linux-image-6.8.0-1024-nvidia-lowlatency-64kUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-xilinx-zynqmp-5.4Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-aws-5.15Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-6.11.0-1010-lowlatency-64kUpgrade linux-image-5.15.0-151-generic-64kUpgrade linux-image-5.15.0-1094-azure-fipsUpgrade linux-image-5.4.0-1108-bluefieldUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1005-realtimeUpgrade linux-image-6.8.0-57-generic-64kUpgrade linux-image-5.4.0-1147-oracleUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-5.4.0-220-genericUpgrade linux-image-4.15.0-1166-kvmUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-5.15.0-1031-nvidia-tegra-igx-rtUpgrade linux-image-azure-4.15Upgrade linux-image-generic-lts-xenialUpgrade linux-image-gkeop-5.15Upgrade linux-image-4.4.0-1116-fipsUpgrade linux-image-6.11.0-18-generic-64kUpgrade linux-image-gcpUpgrade linux-image-5.4.0-220-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-5.15.0-1084-intel-iotgUpgrade linux-image-5.4.0-1152-gcpUpgrade linux-image-nvidiaUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gcp-4.15Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-6.8Upgrade linux-image-lowlatency-5.15Upgrade linux-image-4.15.0-2084-gcp-fipsUpgrade linux-image-oem-24.04Upgrade linux-image-4.4.0-1147-kvmUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.4.0-1053-iotUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-azureUpgrade linux-image-gcp-64kUpgrade linux-image-aws-fips-5.15Upgrade linux-image-5.4.0-1149-aws-fipsUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-hwe-16.04Upgrade linux-image-6.8.0-1022-oracleUpgrade linux-image-generic-5.15Upgrade linux-image-aws-fips-5.4Upgrade linux-image-6.11.0-1009-azureUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-ibm-5.4Upgrade linux-image-5.15.0-1083-nvidiaUpgrade linux-image-6.11.0-1011-oracle-64kUpgrade linux-image-raspi-nolpaeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-1026-gcpUpgrade linux-image-aws-64k-5.15Upgrade linux-image-5.4.0-1149-awsUpgrade linux-image-ibm-classicUpgrade linux-image-5.4.0-1095-ibmUpgrade linux-image-4.4.0-271-genericUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gke-5.15Upgrade linux-image-gcp-fipsUpgrade linux-image-gcp-fips-4.15Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-6.8.0-56-lowlatency-64kUpgrade linux-image-6.8.1-1018-realtimeUpgrade linux-image-raspi-5.4Upgrade linux-image-5.15.0-1053-xilinx-zynqmpUpgrade linux-image-6.8.0-1025-azureUpgrade linux-image-gcp-fips-5.4Upgrade linux-image-azure-cvmUpgrade linux-image-raspi2Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-145-fipsUpgrade linux-image-kvmUpgrade linux-image-4.15.0-1191-azureUpgrade linux-image-oracle-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-aws-hweUpgrade linux-image-aws-5.4Upgrade linux-image-6.8.0-1022-oracle-64kUpgrade linux-image-6.8.0-1022-ibmUpgrade linux-image-6.11.0-1008-raspiUpgrade linux-image-5.15.0-145-lowlatency-64kUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-azure-fips-5.4Upgrade linux-image-generic-5.4Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.11.0-1009-awsUpgrade linux-image-5.4.0-220-generic-lpaeUpgrade linux-image-5.15.0-1086-oracleUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-aws-fips-4.15Upgrade linux-image-virtual-5.15Upgrade linux-image-awsUpgrade linux-image-virtual-5.4Upgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-4.15.0-1138-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1021-gkeUpgrade linux-image-aws-fipsUpgrade linux-image-5.15.0-151-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-azure-fdeUpgrade linux-image-fips-5.4Upgrade linux-image-aws-4.15Upgrade linux-image-5.15.0-1089-realtimeUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-gcp-5.15Upgrade linux-image-aws-lts-20.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-azure-5.4Upgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-azure-nvidiaUpgrade linux-image-4.15.0-240-lowlatencyUpgrade linux-image-6.8.0-56-genericUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-5.15.0-1089-aws-fipsUpgrade linux-image-azure-5.15Upgrade linux-image-gcp-5.4Upgrade linux-image-oracle-5.4Upgrade linux-image-oem-22.04aUpgrade linux-image-5.4.0-1136-kvmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.4.0-1152-gcp-fipsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-azure-fipsUpgrade linux-image-4.4.0-1146-awsUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-4.4.0-1184-awsUpgrade linux-image-5.15.0-1042-nvidia-tegra-rtUpgrade linux-image-azure-fips-4.15Upgrade linux-image-4.15.0-1145-oracleUpgrade linux-image-6.8.0-56-generic-64kUpgrade linux-image-5.15.0-1083-nvidia-lowlatencyUpgrade linux-image-5.15.0-151-generic-lpaeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1082-intel-iot-realtimeUpgrade linux-image-6.11.0-1011-oracleUpgrade linux-image-azure-lts-24.04Upgrade linux-image-oem-22.04bUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-gkeop-6.8Upgrade linux-image-ibmUpgrade linux-image-generic-64k-5.15Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-bluefield-5.4 | Feb 20, 2025 | Oct 29, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 10, 2025 | Oct 29, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub