Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log writer thread Patch series "nilfs2: fix log writer related issues". This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log. This patch (of 3): A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure. The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime. Fix this issue by limiting the use of sc_timer only while the log writer thread is alive.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < 822ae5a8eac30478578a75f7e064f0584931bf2daffectedfdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < 82933c84f188dcfe89eb26b0b48ab5d1ca99d164affectedfdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < 67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148affectedfdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < e65ccf3a4de4f0c763d94789615b83e11f204438affectedfdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < 86a30d6302deddb9fb97ba6fc4b04d0e870b582aaffectedfdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < f9186bba4ea282b07293c1c892441df3a5441cb0affectedfdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < 2f12b2c03c5dae1a0de0a9e5853177e3d6eee3c6affectedfdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < 68e738be5c518fc3c4e9146b66f67c8fee0135fbaffectedfdce895ea5dd4e24edf1f4d693827349a4e5b3b4 to < f5d4e04634c9cf68bdf23de08ada0bb92e8befe7affected
Linux Linux
Default version status: affected
2.6.35affected0 to < 2.6.35unaffected4.19.316 to ≤ 4.19.*unaffected5.4.278 to ≤ 5.4.*unaffected5.10.219 to ≤ 5.10.*unaffected5.15.161 to ≤ 5.15.*unaffected6.1.94 to ≤ 6.1.*unaffected6.6.33 to ≤ 6.6.*unaffected6.8.12 to ≤ 6.8.*unaffected6.9.3 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/822ae5a8eac30478578a75f7e064f0584931bf2d ↗
- https://git.kernel.org/stable/c/82933c84f188dcfe89eb26b0b48ab5d1ca99d164 ↗
- https://git.kernel.org/stable/c/67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148 ↗
- https://git.kernel.org/stable/c/e65ccf3a4de4f0c763d94789615b83e11f204438 ↗
- https://git.kernel.org/stable/c/86a30d6302deddb9fb97ba6fc4b04d0e870b582a ↗
- https://git.kernel.org/stable/c/f9186bba4ea282b07293c1c892441df3a5441cb0 ↗
- https://git.kernel.org/stable/c/2f12b2c03c5dae1a0de0a9e5853177e3d6eee3c6 ↗
- https://git.kernel.org/stable/c/68e738be5c518fc3c4e9146b66f67c8fee0135fb ↗
- https://git.kernel.org/stable/c/f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗