{"id":"CVE-2024-56693","state":"PUBLISHED","title":"brd: defer automatic disk creation until module initialization succeeds","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbrd: defer automatic disk creation until module initialization succeeds\n\nMy colleague Wupeng found the following problems during fault injection:\n\nBUG: unable to handle page fault for address: fffffbfff809d073\nPGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:__asan_load8+0x4c/0xa0\n...\nCall Trace:\n <TASK>\n blkdev_put_whole+0x41/0x70\n bdev_release+0x1a3/0x250\n blkdev_release+0x11/0x20\n __fput+0x1d7/0x4a0\n task_work_run+0xfc/0x180\n syscall_exit_to_user_mode+0x1de/0x1f0\n do_syscall_64+0x6b/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nloop_init() is calling loop_add() after __register_blkdev() succeeds and\nis ignoring disk_add() failure from loop_add(), for loop_add() failure\nis not fatal and successfully created disks are already visible to\nbdev_open().\n\nbrd_init() is currently calling brd_alloc() before __register_blkdev()\nsucceeds and is releasing successfully created disks when brd_init()\nreturns an error. This can cause UAF for the latter two case:\n\ncase 1:\n    T1:\nmodprobe brd\n  brd_init\n    brd_alloc(0) // success\n      add_disk\n        disk_scan_partitions\n          bdev_file_open_by_dev // alloc file\n          fput // won't free until back to userspace\n    brd_alloc(1) // failed since mem alloc error inject\n  // error path for modprobe will release code segment\n  // back to userspace\n  __fput\n    blkdev_release\n      bdev_release\n        blkdev_put_whole\n          bdev->bd_disk->fops->release // fops is freed now, UAF!\n\ncase 2:\n    T1:                            T2:\nmodprobe brd\n  brd_init\n    brd_alloc(0) // success\n                                   open(/dev/ram0)\n    brd_alloc(1) // fail\n  // error path for modprobe\n\n                                   close(/dev/ram0)\n                                   ...\n                                   /* UAF! */\n                                   bdev->bd_disk->fops->release\n\nFix this problem by following what loop_init() does. Besides,\nreintroduce brd_devices_mutex to help serialize modifications to\nbrd_list.","publishedAt":"2024-12-28T09:46:18.203Z","updatedAt":"2026-08-05T11:46:07.115Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"41219c147df8bbd6591f59af5d695fb6c9a1cbff","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"259bf925583ec9e3781df778cadf00594095090d","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"410896624db639500f24f46478b4bfa05c76bf56","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"c0c2744cd2939ec5999c51dbaf2af16886548b7b","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"63dfd728b30f79495dacc886127695a379805152","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"826cc42adf44930a633d11a5993676d85ddb0842","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/brd.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.14","versionType":"semver"},{"version":"5.15.174","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.120","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.64","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.11","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12.2","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/brd.c"]}],"references":["https://git.kernel.org/stable/c/41219c147df8bbd6591f59af5d695fb6c9a1cbff","https://git.kernel.org/stable/c/259bf925583ec9e3781df778cadf00594095090d","https://git.kernel.org/stable/c/410896624db639500f24f46478b4bfa05c76bf56","https://git.kernel.org/stable/c/c0c2744cd2939ec5999c51dbaf2af16886548b7b","https://git.kernel.org/stable/c/63dfd728b30f79495dacc886127695a379805152","https://git.kernel.org/stable/c/826cc42adf44930a633d11a5993676d85ddb0842","https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56693.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56693","state":"PUBLISHED","datePublished":"2024-12-28T09:46:18.203Z","dateUpdated":"2026-08-05T11:46:07.115Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T15:00:39.849Z"},"containers":{"cna":{"title":"brd: defer automatic disk creation until module initialization succeeds","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbrd: defer automatic disk creation until module initialization succeeds\n\nMy colleague Wupeng found the following problems during fault injection:\n\nBUG: unable to handle page fault for address: fffffbfff809d073\nPGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.1-2.fc37 04/01/2014\nRIP: 0010:__asan_load8+0x4c/0xa0\n...\nCall Trace:\n <TASK>\n blkdev_put_whole+0x41/0x70\n bdev_release+0x1a3/0x250\n blkdev_release+0x11/0x20\n __fput+0x1d7/0x4a0\n task_work_run+0xfc/0x180\n syscall_exit_to_user_mode+0x1de/0x1f0\n do_syscall_64+0x6b/0x170\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nloop_init() is calling loop_add() after __register_blkdev() succeeds and\nis ignoring disk_add() failure from loop_add(), for loop_add() failure\nis not fatal and successfully created disks are already visible to\nbdev_open().\n\nbrd_init() is currently calling brd_alloc() before __register_blkdev()\nsucceeds and is releasing successfully created disks when brd_init()\nreturns an error. This can cause UAF for the latter two case:\n\ncase 1:\n    T1:\nmodprobe brd\n  brd_init\n    brd_alloc(0) // success\n      add_disk\n        disk_scan_partitions\n          bdev_file_open_by_dev // alloc file\n          fput // won't free until back to userspace\n    brd_alloc(1) // failed since mem alloc error inject\n  // error path for modprobe will release code segment\n  // back to userspace\n  __fput\n    blkdev_release\n      bdev_release\n        blkdev_put_whole\n          bdev->bd_disk->fops->release // fops is freed now, UAF!\n\ncase 2:\n    T1:                            T2:\nmodprobe brd\n  brd_init\n    brd_alloc(0) // success\n                                   open(/dev/ram0)\n    brd_alloc(1) // fail\n  // error path for modprobe\n\n                                   close(/dev/ram0)\n                                   ...\n                                   /* UAF! */\n                                   bdev->bd_disk->fops->release\n\nFix this problem by following what loop_init() does. Besides,\nreintroduce brd_devices_mutex to help serialize modifications to\nbrd_list."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"41219c147df8bbd6591f59af5d695fb6c9a1cbff","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"259bf925583ec9e3781df778cadf00594095090d","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"410896624db639500f24f46478b4bfa05c76bf56","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"c0c2744cd2939ec5999c51dbaf2af16886548b7b","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"63dfd728b30f79495dacc886127695a379805152","versionType":"git"},{"version":"7f9b348cb5e94259acdcbafbcaed55d3bb515304","status":"affected","lessThan":"826cc42adf44930a633d11a5993676d85ddb0842","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/brd.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.14","versionType":"semver"},{"version":"5.15.174","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.120","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.64","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.11.11","status":"unaffected","lessThanOrEqual":"6.11.*","versionType":"semver"},{"version":"6.12.2","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/block/brd.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/41219c147df8bbd6591f59af5d695fb6c9a1cbff"},{"url":"https://git.kernel.org/stable/c/259bf925583ec9e3781df778cadf00594095090d"},{"url":"https://git.kernel.org/stable/c/410896624db639500f24f46478b4bfa05c76bf56"},{"url":"https://git.kernel.org/stable/c/c0c2744cd2939ec5999c51dbaf2af16886548b7b"},{"url":"https://git.kernel.org/stable/c/63dfd728b30f79495dacc886127695a379805152"},{"url":"https://git.kernel.org/stable/c/826cc42adf44930a633d11a5993676d85ddb0842"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Triggering requires local access — loading/autoloading the brd module and holding an open file descriptor on /dev/ram0 across the failed initialization. There is no network-facing path into drivers/block/brd.c.\nAC:L - The attacker drives the exploitable side of the race directly by spinning open()/close() on /dev/ram0 (or by triggering block-major-1 autoload) and can retry unboundedly because a failed load leaves the major unregistered; the allocation failure that aborts brd_init() is inducible via local memory pressure. This matches the treatment of other allocation/registration error-path UAFs in this subsystem.\nPR:L - The attacker needs only a local account able to open the ram-disk device node (e.g. disk-group membership on stock distros, or the looser block-device permissions common on embedded/Android/appliance systems); no CAP_SYS_MODULE is needed since the module load can be an admin/boot action or kernel-initiated autoload.\nUI:N - No victim action is needed — the attacker's own open() of a major-1 node can trigger the module autoload, and the boot-time load path requires no interactive user involvement.\nS:U - The use-after-free is entirely within kernel memory and yields kernel-level compromise of the same system; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free: disk->fops dangles into freed module memory and disk->private_data into a freed slab object, so the attacker can reclaim those allocations and use the stale references to disclose arbitrary kernel memory.\nI:H - The dangling fops pointer results in an indirect call through freed executable module memory, which is reclaimable by subsequent module loads or BPF JIT allocations, giving a realistic control-flow-hijack/arbitrary-write primitive; the freed brd_device is likewise a heap-spray target.\nA:H - The demonstrated result is a kernel oops (unhandled page fault in blkdev_put_whole() → bdev_release() path), and any use-after-free of this kind reliably panics the machine."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:46:07.115Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"5.15.174"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.1.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.6.64"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.11.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.12.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-56693","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-10T17:12:21.851341Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-10T17:21:06.885Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:52:41.179Z"}}]}}}