In the Linux kernel, the following vulnerability has been resolved: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF The fscache_cookie_lru_timer is initialized when the fscache module is inserted, but is not deleted when the fscache module is removed. If timer_reduce() is called before removing the fscache module, the fscache_cookie_lru_timer will be added to the timer list of the current cpu. Afterwards, a use-after-free will be triggered in the softIRQ after removing the fscache module, as follows: ================================================================== BUG: unable to handle page fault for address: fffffbfff803c9e9 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855 Tainted: [W]=WARN RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Call Trace: <IRQ> tmigr_handle_remote_up+0x627/0x810 __walk_groups.isra.0+0x47/0x140 tmigr_handle_remote+0x1fa/0x2f0 handle_softirqs+0x180/0x590 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 default_idle_call+0x38/0x60 do_idle+0x2b5/0x300 cpu_startup_entry+0x54/0x60 start_secondary+0x20d/0x280 common_startup_64+0x13e/0x148 </TASK> Modules linked in: [last unloaded: netfs] ================================================================== Therefore delete fscache_cookie_lru_timer when removing the fscahe module.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fscache: eliminar fscache_cookie_lru_timer cuando fscache sale para evitar UAF fscache_cookie_lru_timer se inicializa cuando se inserta el módulo fscache, pero no se elimina cuando se elimina el módulo fscache. Si se llama a timer_reduce() antes de eliminar el módulo fscache, fscache_cookie_lru_timer se agregará a la lista de temporizadores de la CPU actual. Posteriormente, se activará un use after free en el softIRQ después de quitar el módulo fscache, de la siguiente manera: ======================================================================== ERROR: no se puede manejar el error de página para la dirección: fffffbfff803c9e9 PF: acceso de lectura del supervisor en modo kernel PF: error_code(0x0000) - página no presente PGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Contaminado: GW 6.11.0-rc3 #855 Contaminado: [W]=ADVERTENCIA RIP: 0010:__run_timer_base.part.0+0x254/0x8a0 Rastreo de llamadas: tmigr_handle_remote_up+0x627/0x810 __walk_groups.isra.0+0x47/0x140 tmigr_handle_remote+0x1fa/0x2f0 handle_softirqs+0x180/0x590 irq_exit_rcu+0x84/0xb0 sysvec_apic_timer_interrupt+0x6e/0x90 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:default_idle+0xf/0x20 default_idle_call+0x38/0x60 do_idle+0x2b5/0x300 cpu_startup_entry+0x54/0x60 start_secondary+0x20d/0x280 common_startup_64+0x13e/0x148 Módulos vinculados en: [última descarga: netfs] ======================================================================= Por lo tanto, elimine fscache_cookie_lru_timer al eliminar el módulo fscahe.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-416
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdc0d1b80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdc389d00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdc0d0380> | Operating System |
| linux | linux_kernel | 6.11 | <built-in method update of dict object at 0x702bdd9a3040> | Operating System |
| linux | linux_kernel | 6.11 | <built-in method update of dict object at 0x702bdc0d20c0> | Operating System |
| linux | linux_kernel | 6.11 | <built-in method update of dict object at 0x702bdc0d3700> | Operating System |
| linux | linux_kernel | 6.11 | <built-in method update of dict object at 0x702c04583ac0> | Operating System |
| linux | linux_kernel | 6.11 | <built-in method update of dict object at 0x702ba70f5a00> | Operating System |
| linux | linux_kernel | 6.11 | <built-in method update of dict object at 0x702bdd9a2900> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:* |