Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
procfs: fix missing RCU protection when reading real_parent in do_task_stat()
When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to:
cpu 0 cpu 1
do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <— Too late to protect task->real_parent! task_pid_ptr <— UAF! rcu_read_unlock
This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent.
Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 6 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , TuxCare 9.6 ESU , Ubuntu 20.04 ELS
- Affected packages:
- kernel @ 4.18.0 (+8 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| AlmaLinux 10 | Released |
44 kernels
|
| AlmaLinux 8 | In Rollout |
113 kernels
|
| AlmaLinux 9 | Released |
113 kernels
|
| Amazon Linux 2023 | Planned | — |
| CentOS 8 | In Rollout |
21 kernels
|
| CloudLinux OS 7h | In Rollout |
106 kernels
|
| CloudLinux OS 8 | In Rollout |
103 kernels
|
| Debian 13 | Planned | — |
| Oracle Linux 8 | In Rollout |
121 kernels
|
| Oracle Linux 9 | Released |
112 kernels
|
| RHEL 10 | Released |
47 kernels
|
| RHEL 8 | In Rollout |
117 kernels
|
| RHEL 9 | Released |
111 kernels
|
| Rocky Linux 10 | Released |
32 kernels
|
| Rocky Linux 8 | In Rollout |
94 kernels
|
| Rocky Linux 9 | Released |
89 kernels
|
| Ubuntu 22.04 | Planned | — |
| Ubuntu 24.04 | Planned | — |
| Ubuntu 24.04 AWS | Planned | — |