In the Linux kernel, the following vulnerability has been resolved:
block, bfq: fix uaf for bfqq in bicsetbfqq()
After commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'"), bic->bfqq will be accessed in bicsetbfqq(), however, in some context bic->bfqq will be freed, and bicsetbfqq() is called with the freed bic->bfqq.
Fix the problem by always freeing bfqq after bicsetbfqq().
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b600de2d7d3a16f9007fad1bdae82a3951a26af2",
"target": {
"file": "block/bfq-iosched.c"
},
"deprecated": false,
"id": "CVE-2023-52983-171f59aa",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"196718246586420976253111750789763899153",
"300196220784817034757328917768369834476",
"93780627803560557317738346802295111214",
"57832444610854860115347534501787953162",
"223793439289811148105735781895175211788",
"332727467924024606037592114280156802943"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77f3dab5066a7c9da73d72d1eee895ff84a8d5",
"target": {
"file": "block/bfq-iosched.c"
},
"deprecated": false,
"id": "CVE-2023-52983-23aea547",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"196718246586420976253111750789763899153",
"236498889615074582874377901605402597974",
"287315537608645733031586430840249787882",
"69958540685788818504181691642959923505",
"259810201119634175090194493103685016149",
"332727467924024606037592114280156802943"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb1876fc33af26d00efdd473311f1b664c77c44e",
"target": {
"function": "bfq_check_ioprio_change",
"file": "block/bfq-iosched.c"
},
"deprecated": false,
"id": "CVE-2023-52983-339ecb96",
"signature_version": "v1",
"digest": {
"length": 478.0,
"function_hash": "71562396045051457253876010026538630351"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb1876fc33af26d00efdd473311f1b664c77c44e",
"target": {
"file": "block/bfq-iosched.c"
},
"deprecated": false,
"id": "CVE-2023-52983-3f6d04a3",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"196718246586420976253111750789763899153",
"300196220784817034757328917768369834476",
"93780627803560557317738346802295111214",
"57832444610854860115347534501787953162",
"223793439289811148105735781895175211788",
"332727467924024606037592114280156802943"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b600de2d7d3a16f9007fad1bdae82a3951a26af2",
"target": {
"function": "bfq_check_ioprio_change",
"file": "block/bfq-iosched.c"
},
"deprecated": false,
"id": "CVE-2023-52983-40c3a059",
"signature_version": "v1",
"digest": {
"length": 478.0,
"function_hash": "71562396045051457253876010026538630351"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77f3dab5066a7c9da73d72d1eee895ff84a8d5",
"target": {
"function": "bfq_check_ioprio_change",
"file": "block/bfq-iosched.c"
},
"deprecated": false,
"id": "CVE-2023-52983-439922c1",
"signature_version": "v1",
"digest": {
"length": 471.0,
"function_hash": "293914830477428793263252738074738327174"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77f3dab5066a7c9da73d72d1eee895ff84a8d5",
"target": {
"function": "__bfq_bic_change_cgroup",
"file": "block/bfq-cgroup.c"
},
"deprecated": false,
"id": "CVE-2023-52983-66c23190",
"signature_version": "v1",
"digest": {
"length": 732.0,
"function_hash": "61103204094698987680488408451184950000"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@511c922c5bf6c8a166bea826e702336bc2424140",
"target": {
"file": "block/bfq-cgroup.c"
},
"deprecated": false,
"id": "CVE-2023-52983-6d01c0f0",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"276073281625341001608397309493846202131",
"227177324466684095121948436256212497344",
"235278043639336339036537730199186465815",
"94131468169379524508979550489384663866",
"170959806838749164115759503690670386971"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@511c922c5bf6c8a166bea826e702336bc2424140",
"target": {
"function": "bfq_check_ioprio_change",
"file": "block/bfq-iosched.c"
},
"deprecated": false,
"id": "CVE-2023-52983-7114df31",
"signature_version": "v1",
"digest": {
"length": 478.0,
"function_hash": "71562396045051457253876010026538630351"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b600de2d7d3a16f9007fad1bdae82a3951a26af2",
"target": {
"file": "block/bfq-cgroup.c"
},
"deprecated": false,
"id": "CVE-2023-52983-a781b82d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"276073281625341001608397309493846202131",
"227177324466684095121948436256212497344",
"235278043639336339036537730199186465815",
"94131468169379524508979550489384663866",
"170959806838749164115759503690670386971"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb1876fc33af26d00efdd473311f1b664c77c44e",
"target": {
"file": "block/bfq-cgroup.c"
},
"deprecated": false,
"id": "CVE-2023-52983-ada58d86",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"276073281625341001608397309493846202131",
"227177324466684095121948436256212497344",
"235278043639336339036537730199186465815",
"94131468169379524508979550489384663866",
"170959806838749164115759503690670386971"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@511c922c5bf6c8a166bea826e702336bc2424140",
"target": {
"function": "__bfq_bic_change_cgroup",
"file": "block/bfq-cgroup.c"
},
"deprecated": false,
"id": "CVE-2023-52983-b01ed33c",
"signature_version": "v1",
"digest": {
"length": 732.0,
"function_hash": "61103204094698987680488408451184950000"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@511c922c5bf6c8a166bea826e702336bc2424140",
"target": {
"file": "block/bfq-iosched.c"
},
"deprecated": false,
"id": "CVE-2023-52983-b30fdc81",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"196718246586420976253111750789763899153",
"300196220784817034757328917768369834476",
"93780627803560557317738346802295111214",
"57832444610854860115347534501787953162",
"223793439289811148105735781895175211788",
"332727467924024606037592114280156802943"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7f77f3dab5066a7c9da73d72d1eee895ff84a8d5",
"target": {
"file": "block/bfq-cgroup.c"
},
"deprecated": false,
"id": "CVE-2023-52983-b9fecf2e",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"276073281625341001608397309493846202131",
"227177324466684095121948436256212497344",
"235278043639336339036537730199186465815",
"94131468169379524508979550489384663866",
"170959806838749164115759503690670386971"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cb1876fc33af26d00efdd473311f1b664c77c44e",
"target": {
"function": "__bfq_bic_change_cgroup",
"file": "block/bfq-cgroup.c"
},
"deprecated": false,
"id": "CVE-2023-52983-ff76581b",
"signature_version": "v1",
"digest": {
"length": 732.0,
"function_hash": "61103204094698987680488408451184950000"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b600de2d7d3a16f9007fad1bdae82a3951a26af2",
"target": {
"function": "__bfq_bic_change_cgroup",
"file": "block/bfq-cgroup.c"
},
"deprecated": false,
"id": "CVE-2023-52983-ff98bfcd",
"signature_version": "v1",
"digest": {
"length": 715.0,
"function_hash": "283340693484247881679661661095578851892"
},
"signature_type": "Function"
}
]