Description
In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 ("xattr: switch to CLASS(fd)").
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c03185f4a23e7f89d84c9981091770e876e64480 to < 9a3a2ae5efbbcaed37551218abed94e23c537157affectedc3a5e3e872f3688ae0dc57bb78ca633921d96a91 to < d151b94967c8247005435b63fc60f8f4baa320daaffectedc3a5e3e872f3688ae0dc57bb78ca633921d96a91 to < a71874379ec8c6e788a61d71b3ad014a8d9a5c08affected8d5863cb33aa424fc27115ee945ad6b96ae2facbaffected6.6.51 to < 6.6.133affected6.10.10 to < 6.11affected
Linux Linux
Default version status: affected
6.11affected0 to < 6.11unaffected6.6.133 to ≤ 6.6.*unaffected6.12.77 to ≤ 6.12.*unaffected6.13 to ≤ *unaffected