Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
blk-cgroup: Fix UAF in blkcg_unpin_online()
blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF:
================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117
CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022
Workqueue: cgwb_release cgwb_release_workfn
Call Trace:
Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online().
Fix it by reading the parent pointer before destroying the blkcg’s blkg’s.
Details
- Affected product:
- AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , TuxCare 9.6 ESU
- Affected packages:
- kernel @ 5.14.0 (+2 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 9 | Released |
79 kernels
|
| AlmaLinux 9.6 ESU | Ready For Release | — |
| Amazon Linux 2023 | Planned | — |
| Debian 11 | Released |
33 kernels
|
| Debian 11 cloud | Released |
13 kernels
|
| Debian 12 | Released |
19 kernels
|
| Oracle Linux 8 UEK 7 | Released |
54 kernels
|
| Oracle Linux 9 | Released |
85 kernels
|
| Oracle Linux 9 UEK 7 | Released |
54 kernels
|
| Proxmox VE 7 5.15 | Released |
47 kernels
|
| RHEL 9 | Released |
79 kernels
|
| Rocky Linux 9 | Released |
67 kernels
|
| Ubuntu 20.04 HWE AWS | Released |
52 kernels
|
| Ubuntu 20.04 HWE Azure | Released |
34 kernels
|
| Ubuntu 22.04 | Released |
67 kernels
|
| Ubuntu 22.04 AWS | Released |
58 kernels
|
| Ubuntu 22.04 Azure | Released |
54 kernels
|
| Ubuntu 24.04 | Released |
19 kernels
|