Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-49854

block, bfq: fix uaf for accessing waker_bfqq after splitting

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for accessing waker_bfqq after splitting After commit 42c306ed7233 ("block, bfq: don't break merge chain in bfq_split_bfqq()"), if the current procress is the last holder of bfqq, the bfqq can be freed after bfq_split_bfqq(). Hence recored the bfqq and then access bfqq->waker_bfqq may trigger UAF. What's more, the waker_bfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe. Fix the problem by adding a helper bfq_waker_bfqq() to check if bfqq->waker_bfqq is in the merge chain, and current procress is the only holder.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • e0c20d88b7dce85d2703bb6ba77bf359959675cd to < 63a07379fdb6c72450cb05294461c6016b8b7726affected
  • de6c5e3a456019d2182e345730e59721714fa0b5 to < de0456460f2abf921e356ed2bd8da87a376680bdaffected
  • 19f3bec2ac4be329b9bd12b18a989b867618d2d8 to < 0780451f03bf518bc032a7c584de8f92e2d39d7faffected
  • 13b3d0e8cb121f99b11918a0d4bcc1ce4647d352 to < 0b8bda0ff17156cd3f60944527c9d8c9f99f1583affected
  • 4780f50ea50cfe8e89fc3747bf3dd155488433bb to < cae58d19121a70329cf971359e2518c93fec04feaffected
  • 42c306ed723321af4003b2a41bb73728cab54f85 to < 1ba0403ac6447f2d63914fb760c44a3b19c44eafaffected
  • 9e813033594b141f61ff0ef0cfaaef292564b041affected
  • 3a5f45a4ad4e1fd36b0a998eef03d76a4f02a2a8affected
  • 3630a18846c7853aa326d3b42fd0a855af7b41bcaffected
  • 4.19.323 to < 4.20affected
  • 5.4.285 to < 5.5affected
  • 5.10.227 to < 5.11affected

Linux Linux

Default version status: unaffected

References