Description
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an internal lookup. This can e.g., happen when pointing acc(2) to /sys/power/resume. At the point the where the write to this file happens the calling task has already exited and called exit_fs(). A lookup will thus trigger a NULL-deref when accessing current->fs. Reorganize the code so that the the final write happens from the workqueue but with the caller's credentials. This preserves the (strange) permission model and has almost no regression risk. This api should stop to exist though.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8acbf4a88c6a98c8ed00afd1a7d1abcca9b4735eaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b03782ae707cc45e65242c7cddd8e28f1c22cde5affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5d5b936cfa4b0d5670ca7420ef165a074bc008ebaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5ee8da9bea70dda492d61f075658939af33d8410affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5c928e14a2ccd99462f2351ead627b58075bb736affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5a59ced8ffc71973d42c82484a719c8f6ac8f7f7affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < a8136afca090412a36429cb6c2543c714d9c0f84affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 56d5f3eba3f5de0efdd556de4ef381e109b973a9affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.4.291 to ≤ 5.4.*unaffected5.10.235 to ≤ 5.10.*unaffected5.15.179 to ≤ 5.15.*unaffected6.1.130 to ≤ 6.1.*unaffected6.6.80 to ≤ 6.6.*unaffected6.12.17 to ≤ 6.12.*unaffected6.13.5 to ≤ 6.13.*unaffected6.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8acbf4a88c6a98c8ed00afd1a7d1abcca9b4735e ↗
- https://git.kernel.org/stable/c/b03782ae707cc45e65242c7cddd8e28f1c22cde5 ↗
- https://git.kernel.org/stable/c/5d5b936cfa4b0d5670ca7420ef165a074bc008eb ↗
- https://git.kernel.org/stable/c/5ee8da9bea70dda492d61f075658939af33d8410 ↗
- https://git.kernel.org/stable/c/5c928e14a2ccd99462f2351ead627b58075bb736 ↗
- https://git.kernel.org/stable/c/5a59ced8ffc71973d42c82484a719c8f6ac8f7f7 ↗
- https://git.kernel.org/stable/c/a8136afca090412a36429cb6c2543c714d9c0f84 ↗
- https://git.kernel.org/stable/c/56d5f3eba3f5de0efdd556de4ef381e109b973a9 ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗