| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024122735-CVE-2024-53227-d872@gregkh>
Date: Fri, 27 Dec 2024 14:53:13 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-53227: scsi: bfa: Fix use-after-free in bfad_im_module_exit()
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20
Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303
Call Trace:
<TASK>
dump_stack_lvl+0x95/0xe0
print_report+0xcb/0x620
kasan_report+0xbd/0xf0
__lock_acquire+0x2aca/0x3a20
lock_acquire+0x19b/0x520
_raw_spin_lock+0x2b/0x40
attribute_container_unregister+0x30/0x160
fc_release_transport+0x19/0x90 [scsi_transport_fc]
bfad_im_module_exit+0x23/0x60 [bfa]
bfad_init+0xdb/0xff0 [bfa]
do_one_initcall+0xdc/0x550
do_init_module+0x22d/0x6b0
load_module+0x4e96/0x5ff0
init_module_from_file+0xcd/0x130
idempotent_init_module+0x330/0x620
__x64_sys_finit_module+0xb3/0x110
do_syscall_64+0xc1/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
</TASK>
Allocated by task 25303:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x7f/0x90
fc_attach_transport+0x4f/0x4740 [scsi_transport_fc]
bfad_im_module_init+0x17/0x80 [bfa]
bfad_init+0x23/0xff0 [bfa]
do_one_initcall+0xdc/0x550
do_init_module+0x22d/0x6b0
load_module+0x4e96/0x5ff0
init_module_from_file+0xcd/0x130
idempotent_init_module+0x330/0x620
__x64_sys_finit_module+0xb3/0x110
do_syscall_64+0xc1/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 25303:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x38/0x50
kfree+0x212/0x480
bfad_im_module_init+0x7e/0x80 [bfa]
bfad_init+0x23/0xff0 [bfa]
do_one_initcall+0xdc/0x550
do_init_module+0x22d/0x6b0
load_module+0x4e96/0x5ff0
init_module_from_file+0xcd/0x130
idempotent_init_module+0x330/0x620
__x64_sys_finit_module+0xb3/0x110
do_syscall_64+0xc1/0x1d0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Above issue happens as follows:
bfad_init
error = bfad_im_module_init()
fc_release_transport(bfad_im_scsi_transport_template);
if (error)
goto ext;
ext:
bfad_im_module_exit();
fc_release_transport(bfad_im_scsi_transport_template);
--> Trigger double release
Don't call bfad_im_module_exit() if bfad_im_module_init() failed.
The Linux kernel CVE team has assigned CVE-2024-53227 to this issue.
Affected and fixed versions
===========================
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 4.19.325 with commit 0ceac8012d3ddea3317f0d82934293d05feb8af1
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 5.4.287 with commit 3932c753f805a02e9364a4c58b590f21901f8490
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 5.10.231 with commit ef2c2580189ea88a0dcaf56eb3a565763a900edb
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 5.15.174 with commit e76181a5be90abcc3ed8a300bd13878aa214d022
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 6.1.120 with commit 8f5a97443b547b4c83f876f1d6a11df0f1fd4efb
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 6.6.64 with commit c28409f851abd93b37969cac7498828ad533afd9
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 6.11.11 with commit 1ffdde30a90bf8efe8f270407f486706962b3292
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 6.12.2 with commit a2b5035ab0e368e8d8a371e27fbc72f133c0bd40
Issue introduced in 2.6.32 with commit 7725ccfda59715ecf8f99e3b520a0b84cc2ea79e and fixed in 6.13-rc1 with commit 178b8f38932d635e90f5f0e9af1986c6f4a89271
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2024-53227
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
drivers/scsi/bfa/bfad.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/0ceac8012d3ddea3317f0d82934293d05feb8af1
https://git.kernel.org/stable/c/3932c753f805a02e9364a4c58b590f21901f8490
https://git.kernel.org/stable/c/ef2c2580189ea88a0dcaf56eb3a565763a900edb
https://git.kernel.org/stable/c/e76181a5be90abcc3ed8a300bd13878aa214d022
https://git.kernel.org/stable/c/8f5a97443b547b4c83f876f1d6a11df0f1fd4efb
https://git.kernel.org/stable/c/c28409f851abd93b37969cac7498828ad533afd9
https://git.kernel.org/stable/c/1ffdde30a90bf8efe8f270407f486706962b3292
https://git.kernel.org/stable/c/a2b5035ab0e368e8d8a371e27fbc72f133c0bd40
https://git.kernel.org/stable/c/178b8f38932d635e90f5f0e9af1986c6f4a89271
Powered by blists - more mailing lists