linux-cve-announce - CVE-2024-49854: block, bfq: fix uaf for accessing waker

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024102153-CVE-2024-49854-1ba5@gregkh>
Date: Mon, 21 Oct 2024 14:18:56 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-49854: block, bfq: fix uaf for accessing waker_bfqq after splitting

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

block, bfq: fix uaf for accessing waker_bfqq after splitting

After commit 42c306ed7233 ("block, bfq: don't break merge chain in
bfq_split_bfqq()"), if the current procress is the last holder of bfqq,
the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and
then access bfqq->waker_bfqq may trigger UAF. What's more, the waker_bfqq
may in the merge chain of bfqq, hence just recored waker_bfqq is still
not safe.

Fix the problem by adding a helper bfq_waker_bfqq() to check if
bfqq->waker_bfqq is in the merge chain, and current procress is the only
holder.

The Linux kernel CVE team has assigned CVE-2024-49854 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.227 with commit 3630a18846c7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-49854
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	block/bfq-iosched.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/63a07379fdb6c72450cb05294461c6016b8b7726
	https://git.kernel.org/stable/c/de0456460f2abf921e356ed2bd8da87a376680bd
	https://git.kernel.org/stable/c/0780451f03bf518bc032a7c584de8f92e2d39d7f
	https://git.kernel.org/stable/c/0b8bda0ff17156cd3f60944527c9d8c9f99f1583
	https://git.kernel.org/stable/c/cae58d19121a70329cf971359e2518c93fec04fe
	https://git.kernel.org/stable/c/1ba0403ac6447f2d63914fb760c44a3b19c44eaf