AZL-59043
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-59043.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-59043
- Upstream
- Published
- 2025-02-27T02:15:16Z
- Modified
- 2026-04-21T04:37:11Z
- Summary
- CVE-2025-21731 affecting package kernel for versions less than 5.15.180.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nbd: don't allow reconnect after disconnect
Following process can cause nbd_config UAF:
-
grab nbd_config temporarily;
-
nbd_genl_disconnect() flush all recv_work() and release the initial reference:
nbd_genl_disconnect nbd_disconnect_and_put nbd_disconnect flush_workqueue(nbd->recv_workq) if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, ...)) nbd_config_put -> due to step 1), reference is still not zero
- nbd_genl_reconfigure() queue recv_work() again;
nbd_genl_reconfigure config = nbd_get_config_unlocked(nbd) if (!config) -> succeed if (!test_bit(NBD_RT_BOUND, ...)) -> succeed nbd_reconnect_socket queue_work(nbd->recv_workq, &args->work)
-
step 1) release the reference;
-
Finially, recv_work() will trigger UAF:
recv_work nbd_config_put(nbd) -> nbd_config is freed atomic_dec(&config->recv_threads) -> UAF
Fix the problem by clearing NBD_RT_BOUND in nbd_genl_disconnect(), so that nbd_genl_reconfigure() will fail.
-
- References