Description
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can aand does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c961ee5f21b202dea60b63eeef945730d92e46a6 to < a92c5e5086a87d082696245a8607666da3d80554affectedc961ee5f21b202dea60b63eeef945730d92e46a6 to < 667df93769c02ff581c77d2d8f162147e719c557affectedc961ee5f21b202dea60b63eeef945730d92e46a6 to < 3ddb961d2929bbb3204a2bba21b5d8153cd3f7ccaffectedc961ee5f21b202dea60b63eeef945730d92e46a6 to < ae10787d955fb255d381e0d5589451dd72c614b1affectedc961ee5f21b202dea60b63eeef945730d92e46a6 to < eecce026399917f6efa532c56bc7a3e9dd6ee68baffectedc961ee5f21b202dea60b63eeef945730d92e46a6 to < 13bc2772414d68e94e273dea013181a986948ddfaffectedc961ee5f21b202dea60b63eeef945730d92e46a6 to < 2a732ed26fbd048e7925d227af8cf9ea43fb5cc9affectedc961ee5f21b202dea60b63eeef945730d92e46a6 to < 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3affected
Linux Linux
Default version status: affected
4.13affected0 to < 4.13unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.169 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.77 to ≤ 6.12.*unaffected6.18.18 to ≤ 6.18.*unaffected6.19.8 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/a92c5e5086a87d082696245a8607666da3d80554 ↗
- https://git.kernel.org/stable/c/667df93769c02ff581c77d2d8f162147e719c557 ↗
- https://git.kernel.org/stable/c/3ddb961d2929bbb3204a2bba21b5d8153cd3f7cc ↗
- https://git.kernel.org/stable/c/ae10787d955fb255d381e0d5589451dd72c614b1 ↗
- https://git.kernel.org/stable/c/eecce026399917f6efa532c56bc7a3e9dd6ee68b ↗
- https://git.kernel.org/stable/c/13bc2772414d68e94e273dea013181a986948ddf ↗
- https://git.kernel.org/stable/c/2a732ed26fbd048e7925d227af8cf9ea43fb5cc9 ↗
- https://git.kernel.org/stable/c/8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 ↗