In the Linux kernel, the following vulnerability has been resolved:
rbd: avoid use-after-free in dorbdadd() when rbddevcreate() fails
If getting an ID or setting up a work queue in rbddevcreate() fails, use-after-free on rbddev->rbdclient, rbddev->spec and rbddev->opts is triggered in dorbdadd(). The root cause is that the ownership of these structures is transfered to rbddev prematurely and they all end up getting freed when rbddevcreate() calls rbddevfree() prior to returning to dorbd_add().
Found by Linux Verification Center (linuxtesting.org) with SVACE, an incomplete patch submitted by Natalia Petrova n.petrova@fintech.ru.
[
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-05d0a293",
"digest": {
"function_hash": "233003066951473501091421300679382930424",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae16346078b1189aee934afd872d9f3d0a682c33",
"signature_type": "Function",
"target": {
"function": "__rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-1a89e8fb",
"digest": {
"line_hashes": [
"130638010415811425566674474937054522243",
"216553470705909784547700736953215928577",
"27241440811011629799101175185986273006",
"307194041509789492415268655835872219769",
"79321977087233808453467937513699618360",
"280546765126422768348121217369007032217",
"289901120802230088862021542489727737711",
"66805204422158277221161996943650603572",
"59584395236975919964191842430119171341",
"213369471721690129750315279627763755557",
"285825277520115709711160993025181226769",
"222106935836883718987397229330753519103",
"67087019931466099018336459475268467748",
"207364544712040277477197951904226876983",
"53723983575051413634663070100535481662",
"151840746871891484453219567873252121360",
"72582608425424647071265372013621936126",
"252750666452418348861083183656157284554",
"220176712851181081764856290001380596450",
"253734798671039914010754754971549481807",
"110335568575177783213762349769831009959",
"182724036071663475401876440875821857510",
"7904316270518428132836852656037083675",
"277530416239096392925402170228602529079",
"271017818889493685588757485001144633978",
"168296785906656414493851018969853214247",
"253932012198032331996092910944228260628",
"157173437847633785284654688934804366710",
"227375888949562884094149987123004410216"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71da2a151ed1adb0aea4252b16d81b53012e7afd",
"signature_type": "Line",
"target": {
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-1b25e830",
"digest": {
"function_hash": "291487841404033812534033568663544915589",
"length": 704.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a73783e4e0c4d1507794da211eeca75498544dff",
"signature_type": "Function",
"target": {
"function": "rbd_dev_probe_parent",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-1e897004",
"digest": {
"function_hash": "312465887291212339588154395717106625919",
"length": 721.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faa7b683e436664fff5648426950718277831348",
"signature_type": "Function",
"target": {
"function": "rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-1f5cf4e9",
"digest": {
"function_hash": "312465887291212339588154395717106625919",
"length": 721.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc8c0dd2984503ed09efa37bcafcef3d3da104e8",
"signature_type": "Function",
"target": {
"function": "rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-22f62d4a",
"digest": {
"function_hash": "312465887291212339588154395717106625919",
"length": 721.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae16346078b1189aee934afd872d9f3d0a682c33",
"signature_type": "Function",
"target": {
"function": "rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-23a05c2d",
"digest": {
"function_hash": "97440431984880636867162147832712857576",
"length": 650.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3cbb4d60764295992c95344f2d779439e8b34ce",
"signature_type": "Function",
"target": {
"function": "rbd_dev_probe_parent",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-35d6e43f",
"digest": {
"line_hashes": [
"130638010415811425566674474937054522243",
"216553470705909784547700736953215928577",
"27241440811011629799101175185986273006",
"307194041509789492415268655835872219769",
"79321977087233808453467937513699618360",
"280546765126422768348121217369007032217",
"289901120802230088862021542489727737711",
"66805204422158277221161996943650603572",
"59584395236975919964191842430119171341",
"213369471721690129750315279627763755557",
"285825277520115709711160993025181226769",
"222106935836883718987397229330753519103",
"67087019931466099018336459475268467748",
"207364544712040277477197951904226876983",
"53723983575051413634663070100535481662",
"151840746871891484453219567873252121360",
"72582608425424647071265372013621936126",
"252750666452418348861083183656157284554",
"220176712851181081764856290001380596450",
"253734798671039914010754754971549481807",
"110335568575177783213762349769831009959",
"182724036071663475401876440875821857510",
"7904316270518428132836852656037083675",
"277530416239096392925402170228602529079",
"271017818889493685588757485001144633978",
"168296785906656414493851018969853214247",
"216459383947775705921480629438591855541",
"119787237953182562635094119238122139996",
"242952431141755097402081771188338931212"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faa7b683e436664fff5648426950718277831348",
"signature_type": "Line",
"target": {
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-37f206ba",
"digest": {
"function_hash": "233003066951473501091421300679382930424",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc8c0dd2984503ed09efa37bcafcef3d3da104e8",
"signature_type": "Function",
"target": {
"function": "__rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-49ab5e5a",
"digest": {
"line_hashes": [
"130638010415811425566674474937054522243",
"216553470705909784547700736953215928577",
"27241440811011629799101175185986273006",
"307194041509789492415268655835872219769",
"79321977087233808453467937513699618360",
"280546765126422768348121217369007032217",
"289901120802230088862021542489727737711",
"66805204422158277221161996943650603572",
"59584395236975919964191842430119171341",
"213369471721690129750315279627763755557",
"285825277520115709711160993025181226769",
"222106935836883718987397229330753519103",
"67087019931466099018336459475268467748",
"207364544712040277477197951904226876983",
"53723983575051413634663070100535481662",
"151840746871891484453219567873252121360",
"72582608425424647071265372013621936126",
"252750666452418348861083183656157284554",
"220176712851181081764856290001380596450",
"253734798671039914010754754971549481807",
"110335568575177783213762349769831009959",
"182724036071663475401876440875821857510",
"7904316270518428132836852656037083675",
"277530416239096392925402170228602529079",
"271017818889493685588757485001144633978",
"168296785906656414493851018969853214247",
"216459383947775705921480629438591855541",
"119787237953182562635094119238122139996",
"242952431141755097402081771188338931212"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc8c0dd2984503ed09efa37bcafcef3d3da104e8",
"signature_type": "Line",
"target": {
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-63bec3c0",
"digest": {
"function_hash": "312465887291212339588154395717106625919",
"length": 721.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9787b328c42c13c4f31e7d5042c4e877e9344068",
"signature_type": "Function",
"target": {
"function": "rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-670f780c",
"digest": {
"function_hash": "291487841404033812534033568663544915589",
"length": 704.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faa7b683e436664fff5648426950718277831348",
"signature_type": "Function",
"target": {
"function": "rbd_dev_probe_parent",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-76896b88",
"digest": {
"function_hash": "9674209208543353818788505945437949784",
"length": 1258.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3cbb4d60764295992c95344f2d779439e8b34ce",
"signature_type": "Function",
"target": {
"function": "__rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-8cf49782",
"digest": {
"function_hash": "233003066951473501091421300679382930424",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a73783e4e0c4d1507794da211eeca75498544dff",
"signature_type": "Function",
"target": {
"function": "__rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-9006530d",
"digest": {
"function_hash": "312465887291212339588154395717106625919",
"length": 721.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a73783e4e0c4d1507794da211eeca75498544dff",
"signature_type": "Function",
"target": {
"function": "rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-981c42c9",
"digest": {
"line_hashes": [
"130638010415811425566674474937054522243",
"216553470705909784547700736953215928577",
"27241440811011629799101175185986273006",
"307194041509789492415268655835872219769",
"79321977087233808453467937513699618360",
"280546765126422768348121217369007032217",
"289901120802230088862021542489727737711",
"66805204422158277221161996943650603572",
"59584395236975919964191842430119171341",
"213369471721690129750315279627763755557",
"285825277520115709711160993025181226769",
"222106935836883718987397229330753519103",
"67087019931466099018336459475268467748",
"207364544712040277477197951904226876983",
"53723983575051413634663070100535481662",
"151840746871891484453219567873252121360",
"72582608425424647071265372013621936126",
"252750666452418348861083183656157284554",
"220176712851181081764856290001380596450",
"253734798671039914010754754971549481807",
"110335568575177783213762349769831009959",
"182724036071663475401876440875821857510",
"7904316270518428132836852656037083675",
"277530416239096392925402170228602529079",
"271017818889493685588757485001144633978",
"168296785906656414493851018969853214247",
"253932012198032331996092910944228260628",
"157173437847633785284654688934804366710",
"227375888949562884094149987123004410216"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3cbb4d60764295992c95344f2d779439e8b34ce",
"signature_type": "Line",
"target": {
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-9837fa25",
"digest": {
"function_hash": "291487841404033812534033568663544915589",
"length": 704.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae16346078b1189aee934afd872d9f3d0a682c33",
"signature_type": "Function",
"target": {
"function": "rbd_dev_probe_parent",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-a410eba8",
"digest": {
"function_hash": "312465887291212339588154395717106625919",
"length": 721.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3cbb4d60764295992c95344f2d779439e8b34ce",
"signature_type": "Function",
"target": {
"function": "rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-aa4b859f",
"digest": {
"function_hash": "233003066951473501091421300679382930424",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7c4d9b133c7a04ca619355574e96b6abf209fba",
"signature_type": "Function",
"target": {
"function": "__rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-b6ed1ba8",
"digest": {
"line_hashes": [
"130638010415811425566674474937054522243",
"216553470705909784547700736953215928577",
"27241440811011629799101175185986273006",
"307194041509789492415268655835872219769",
"79321977087233808453467937513699618360",
"280546765126422768348121217369007032217",
"289901120802230088862021542489727737711",
"66805204422158277221161996943650603572",
"59584395236975919964191842430119171341",
"213369471721690129750315279627763755557",
"285825277520115709711160993025181226769",
"222106935836883718987397229330753519103",
"67087019931466099018336459475268467748",
"207364544712040277477197951904226876983",
"53723983575051413634663070100535481662",
"151840746871891484453219567873252121360",
"72582608425424647071265372013621936126",
"252750666452418348861083183656157284554",
"220176712851181081764856290001380596450",
"253734798671039914010754754971549481807",
"110335568575177783213762349769831009959",
"182724036071663475401876440875821857510",
"7904316270518428132836852656037083675",
"277530416239096392925402170228602529079",
"271017818889493685588757485001144633978",
"168296785906656414493851018969853214247",
"216459383947775705921480629438591855541",
"119787237953182562635094119238122139996",
"242952431141755097402081771188338931212"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae16346078b1189aee934afd872d9f3d0a682c33",
"signature_type": "Line",
"target": {
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-bb37bfe2",
"digest": {
"line_hashes": [
"130638010415811425566674474937054522243",
"216553470705909784547700736953215928577",
"27241440811011629799101175185986273006",
"307194041509789492415268655835872219769",
"79321977087233808453467937513699618360",
"280546765126422768348121217369007032217",
"289901120802230088862021542489727737711",
"66805204422158277221161996943650603572",
"59584395236975919964191842430119171341",
"213369471721690129750315279627763755557",
"285825277520115709711160993025181226769",
"222106935836883718987397229330753519103",
"67087019931466099018336459475268467748",
"207364544712040277477197951904226876983",
"53723983575051413634663070100535481662",
"151840746871891484453219567873252121360",
"72582608425424647071265372013621936126",
"252750666452418348861083183656157284554",
"220176712851181081764856290001380596450",
"253734798671039914010754754971549481807",
"110335568575177783213762349769831009959",
"182724036071663475401876440875821857510",
"7904316270518428132836852656037083675",
"277530416239096392925402170228602529079",
"271017818889493685588757485001144633978",
"168296785906656414493851018969853214247",
"253932012198032331996092910944228260628",
"157173437847633785284654688934804366710",
"227375888949562884094149987123004410216"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9787b328c42c13c4f31e7d5042c4e877e9344068",
"signature_type": "Line",
"target": {
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-c87c9d9a",
"digest": {
"function_hash": "291487841404033812534033568663544915589",
"length": 704.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cc8c0dd2984503ed09efa37bcafcef3d3da104e8",
"signature_type": "Function",
"target": {
"function": "rbd_dev_probe_parent",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-cf7cc199",
"digest": {
"line_hashes": [
"130638010415811425566674474937054522243",
"216553470705909784547700736953215928577",
"27241440811011629799101175185986273006",
"307194041509789492415268655835872219769",
"79321977087233808453467937513699618360",
"280546765126422768348121217369007032217",
"289901120802230088862021542489727737711",
"66805204422158277221161996943650603572",
"59584395236975919964191842430119171341",
"213369471721690129750315279627763755557",
"285825277520115709711160993025181226769",
"222106935836883718987397229330753519103",
"67087019931466099018336459475268467748",
"207364544712040277477197951904226876983",
"53723983575051413634663070100535481662",
"151840746871891484453219567873252121360",
"72582608425424647071265372013621936126",
"252750666452418348861083183656157284554",
"220176712851181081764856290001380596450",
"253734798671039914010754754971549481807",
"110335568575177783213762349769831009959",
"182724036071663475401876440875821857510",
"7904316270518428132836852656037083675",
"277530416239096392925402170228602529079",
"271017818889493685588757485001144633978",
"168296785906656414493851018969853214247",
"216459383947775705921480629438591855541",
"119787237953182562635094119238122139996",
"242952431141755097402081771188338931212"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7c4d9b133c7a04ca619355574e96b6abf209fba",
"signature_type": "Line",
"target": {
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-d4985468",
"digest": {
"function_hash": "233003066951473501091421300679382930424",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faa7b683e436664fff5648426950718277831348",
"signature_type": "Function",
"target": {
"function": "__rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-e16b36c7",
"digest": {
"function_hash": "233003066951473501091421300679382930424",
"length": 1455.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9787b328c42c13c4f31e7d5042c4e877e9344068",
"signature_type": "Function",
"target": {
"function": "__rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-e5f03881",
"digest": {
"function_hash": "291487841404033812534033568663544915589",
"length": 704.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7c4d9b133c7a04ca619355574e96b6abf209fba",
"signature_type": "Function",
"target": {
"function": "rbd_dev_probe_parent",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-e7487f44",
"digest": {
"function_hash": "266068790468768483897842258874823181314",
"length": 1099.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71da2a151ed1adb0aea4252b16d81b53012e7afd",
"signature_type": "Function",
"target": {
"function": "__rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-ee74755a",
"digest": {
"line_hashes": [
"130638010415811425566674474937054522243",
"216553470705909784547700736953215928577",
"27241440811011629799101175185986273006",
"307194041509789492415268655835872219769",
"79321977087233808453467937513699618360",
"280546765126422768348121217369007032217",
"289901120802230088862021542489727737711",
"66805204422158277221161996943650603572",
"59584395236975919964191842430119171341",
"213369471721690129750315279627763755557",
"285825277520115709711160993025181226769",
"222106935836883718987397229330753519103",
"67087019931466099018336459475268467748",
"207364544712040277477197951904226876983",
"53723983575051413634663070100535481662",
"151840746871891484453219567873252121360",
"72582608425424647071265372013621936126",
"252750666452418348861083183656157284554",
"220176712851181081764856290001380596450",
"253734798671039914010754754971549481807",
"110335568575177783213762349769831009959",
"182724036071663475401876440875821857510",
"7904316270518428132836852656037083675",
"277530416239096392925402170228602529079",
"271017818889493685588757485001144633978",
"168296785906656414493851018969853214247",
"216459383947775705921480629438591855541",
"119787237953182562635094119238122139996",
"242952431141755097402081771188338931212"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a73783e4e0c4d1507794da211eeca75498544dff",
"signature_type": "Line",
"target": {
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-f2baa92b",
"digest": {
"function_hash": "312465887291212339588154395717106625919",
"length": 721.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7c4d9b133c7a04ca619355574e96b6abf209fba",
"signature_type": "Function",
"target": {
"function": "rbd_dev_create",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-f359a6da",
"digest": {
"function_hash": "97440431984880636867162147832712857576",
"length": 650.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9787b328c42c13c4f31e7d5042c4e877e9344068",
"signature_type": "Function",
"target": {
"function": "rbd_dev_probe_parent",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-f5f4783d",
"digest": {
"function_hash": "97440431984880636867162147832712857576",
"length": 650.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71da2a151ed1adb0aea4252b16d81b53012e7afd",
"signature_type": "Function",
"target": {
"function": "rbd_dev_probe_parent",
"file": "drivers/block/rbd.c"
}
},
{
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53307-f67e693c",
"digest": {
"function_hash": "312465887291212339588154395717106625919",
"length": 721.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@71da2a151ed1adb0aea4252b16d81b53012e7afd",
"signature_type": "Function",
"target": {
"function": "rbd_dev_create",
"file": "drivers/block/rbd.c"
}
}
]