Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
ext4: fix use-after-free in ext4_orphan_cleanup
I caught a issue as follows:
BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0 Read of size 8 at addr ffff88814b13f378 by task mount/710
CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370
Call Trace:
dump_stack_lvl+0x73/0x9f
print_report+0x25d/0x759
kasan_report+0xc0/0x120
__asan_load8+0x99/0x140
__list_add_valid+0x28/0x1a0
ext4_orphan_cleanup+0x564/0x9d0 [ext4]
__ext4_fill_super+0x48e2/0x5300 [ext4]
ext4_fill_super+0x19f/0x3a0 [ext4]
get_tree_bdev+0x27b/0x450
ext4_get_tree+0x19/0x30 [ext4]
vfs_get_tree+0x49/0x150
path_mount+0xaae/0x1350
do_mount+0xe2/0x110
__x64_sys_mount+0xf0/0x190
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
[…]
Above issue may happen as follows:
ext4_fill_super ext4_orphan_cleanup — loop1: assume last_orphan is 12 — list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan) ext4_truncate –> return 0 ext4_inode_attach_jinode –> return -ENOMEM iput(inode) –> free inode<12> — loop2: last_orphan is still 12 — list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan); // use inode<12> and trigger UAF
To solve this issue, we need to propagate the return value of ext4_inode_attach_jinode() appropriately.
Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 7 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU
- Affected packages:
- kernel @ 3.10.0 (+9 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 8 | Released |
91 kernels
|
| AlmaLinux 9.2 ESU | Released |
12 kernels
|
| Amazon Linux 2 5.10 | Planned | — |
| Amazon Linux 2 5.4 | Planned | — |
| CentOS 7 | Released |
35 kernels
|
| CentOS 7 plus | Released |
23 kernels
|
| CentOS 8 | Released |
21 kernels
|
| CloudLinux OS 7h | Released |
90 kernels
|
| CloudLinux OS 8 | Released |
89 kernels
|
| Oracle Linux 7 | Released |
50 kernels
|
| Oracle Linux 8 | Released |
104 kernels
|
| RHEL 7 | Released |
53 kernels
|
| RHEL 8 | Released |
99 kernels
|
| RHEL8 EUS 8.6 | Released |
58 kernels
|
| RHEL 9 | Will Not Fix | — |
| Rocky Linux 8 | Released |
78 kernels
|
| Ubuntu 20.04 | Planned | — |
| Ubuntu 22.04 | Planned | — |