CVSS 5.5 · Medium EPSS 0,24%
Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: release page in error path to avoid BUG_ON Consider the following sequence of events: 1. Userspace issues a UFFD ioctl, which ends up calling into shmem_mfill_atomic_pte(). We successfully account the blocks, we shmem_alloc_page(), but then the copy_from_user() fails. We return -ENOENT. We don't release the page we allocated. 2. Our caller detects this error code, tries the copy_from_user() after dropping the mmap_lock, and retries, calling back into shmem_mfill_atomic_pte(). 3. Meanwhile, let's say another process filled up the tmpfs being used. 4. So shmem_mfill_atomic_pte() fails to account blocks this time, and immediately returns - without releasing the page. This triggers a BUG_ON in our caller, which asserts that the page should always be consumed, unless -ENOENT is returned. To fix this, detect if we have such a "dangling" page when accounting fails, and if so, release it before returning.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 4.11 hingga sebelum 4.14.233 |
| linux | linux kernel | Versi 4.15 hingga sebelum 4.19.191 |
| linux | linux kernel | Versi 4.20 hingga sebelum 5.4.120 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.38 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.11.22 |
| linux | linux kernel | Versi 5.12 hingga sebelum 5.12.5 |
| linux | linux kernel | Versi 5.13 rc1 |