Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rtrs: Fix use-after-free in path file creation cleanup
In the error path of rtrs_srv_create_path_files(), the sysfs root folders may already have been created and srv_path->kobj may already have been initialized. If a later step fails, the cleanup currently calls kobject_put(&srv_path->kobj) before rtrs_srv_destroy_once_sysfs_root_folders(srv_path).
kobject_put() may drop the last reference to srv_path->kobj and invoke the release callback, rtrs_srv_release(), which frees srv_path. The following call to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then dereferences srv_path internally to access srv_path->srv, resulting in a use-after-free.
This failure path is reached before rtrs_srv_create_path_files() returns success, so the successful-path lifetime handling is not involved.
Fix this by destroying the sysfs root folders before calling kobject_put(&srv_path->kobj), so srv_path is still valid while the helper accesses it.
This issue was found by a static analysis tool I am developing.
Details
- Affected product:
- Ubuntu 20.04 ELS
- Affected packages:
- linux @ 5.4.0 (+1 more)
Fixes
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Debian 12 | Planned | — |
| Proxmox VE 7 5.15 | Will Not Fix |
47 kernels
|
| Ubuntu 20.04 HWE AWS | Will Not Fix |
57 kernels
|
| Ubuntu 20.04 HWE Azure | Will Not Fix |
40 kernels
|
| Ubuntu 22.04 | Will Not Fix |
97 kernels
|
| Ubuntu 22.04 AWS | Will Not Fix |
88 kernels
|
| Ubuntu 22.04 Azure | Will Not Fix |
78 kernels
|