In the Linux kernel, the following vulnerability has been resolved:
block, bfq: fix uaf for accessing waker_bfqq after splitting
After commit 42c306ed7233 ("block, bfq: don't break merge chain in bfqsplitbfqq()"), if the current procress is the last holder of bfqq, the bfqq can be freed after bfqsplitbfqq(). Hence recored the bfqq and then access bfqq->wakerbfqq may trigger UAF. What's more, the wakerbfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe.
Fix the problem by adding a helper bfqwakerbfqq() to check if bfqq->waker_bfqq is in the merge chain, and current procress is the only holder.
[
{
"signature_type": "Function",
"digest": {
"function_hash": "278718393058356248141723752370546924587",
"length": 1625.0
},
"deprecated": false,
"id": "CVE-2024-49854-054c5034",
"target": {
"function": "bfq_init_rq",
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63a07379fdb6c72450cb05294461c6016b8b7726",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "289302454419313550135481882776638098086",
"length": 1694.0
},
"deprecated": false,
"id": "CVE-2024-49854-2a03c98d",
"target": {
"function": "bfq_init_rq",
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b8bda0ff17156cd3f60944527c9d8c9f99f1583",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80673243509769431810399986092208903920",
"42367234864772502367756514641361259052",
"232172362918513112238152125068806268284",
"71254542691951724746404900293223714350",
"6982996531472958650788495429338758606",
"63162610007625571402144820155316132484",
"227576570739040412250470208258886655925",
"224772022315347818354304673816783578550",
"101764375861745711669362260634314830028",
"149877513833818077350949956901431141382",
"201398068586773800303963951886266888234",
"300891304781371840933364517128956076075",
"28830909656863080889315129221040206337"
]
},
"deprecated": false,
"id": "CVE-2024-49854-37c29bb7",
"target": {
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de0456460f2abf921e356ed2bd8da87a376680bd",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80673243509769431810399986092208903920",
"42367234864772502367756514641361259052",
"232172362918513112238152125068806268284",
"232544867015414797001560673255744230654",
"155261162094914207004409952778153830138",
"205105403042652145554685807580824216066",
"233479774908288639812597891410665500989",
"224772022315347818354304673816783578550",
"101764375861745711669362260634314830028",
"149877513833818077350949956901431141382",
"201398068586773800303963951886266888234",
"300891304781371840933364517128956076075",
"28830909656863080889315129221040206337"
]
},
"deprecated": false,
"id": "CVE-2024-49854-3dc01d9f",
"target": {
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ba0403ac6447f2d63914fb760c44a3b19c44eaf",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80673243509769431810399986092208903920",
"42367234864772502367756514641361259052",
"232172362918513112238152125068806268284",
"232544867015414797001560673255744230654",
"155261162094914207004409952778153830138",
"205105403042652145554685807580824216066",
"233479774908288639812597891410665500989",
"224772022315347818354304673816783578550",
"101764375861745711669362260634314830028",
"149877513833818077350949956901431141382",
"201398068586773800303963951886266888234",
"300891304781371840933364517128956076075",
"28830909656863080889315129221040206337"
]
},
"deprecated": false,
"id": "CVE-2024-49854-44d3673d",
"target": {
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0780451f03bf518bc032a7c584de8f92e2d39d7f",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "289302454419313550135481882776638098086",
"length": 1694.0
},
"deprecated": false,
"id": "CVE-2024-49854-5ddd9015",
"target": {
"function": "bfq_init_rq",
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cae58d19121a70329cf971359e2518c93fec04fe",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "208922244247490345871712721248875468196",
"length": 1622.0
},
"deprecated": false,
"id": "CVE-2024-49854-66f02e84",
"target": {
"function": "bfq_init_rq",
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de0456460f2abf921e356ed2bd8da87a376680bd",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "289302454419313550135481882776638098086",
"length": 1694.0
},
"deprecated": false,
"id": "CVE-2024-49854-69b82958",
"target": {
"function": "bfq_init_rq",
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0780451f03bf518bc032a7c584de8f92e2d39d7f",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80673243509769431810399986092208903920",
"42367234864772502367756514641361259052",
"232172362918513112238152125068806268284",
"232544867015414797001560673255744230654",
"155261162094914207004409952778153830138",
"205105403042652145554685807580824216066",
"233479774908288639812597891410665500989",
"224772022315347818354304673816783578550",
"101764375861745711669362260634314830028",
"149877513833818077350949956901431141382",
"201398068586773800303963951886266888234",
"300891304781371840933364517128956076075",
"28830909656863080889315129221040206337"
]
},
"deprecated": false,
"id": "CVE-2024-49854-962e55a0",
"target": {
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cae58d19121a70329cf971359e2518c93fec04fe",
"signature_version": "v1"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "289302454419313550135481882776638098086",
"length": 1694.0
},
"deprecated": false,
"id": "CVE-2024-49854-d21de85d",
"target": {
"function": "bfq_init_rq",
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ba0403ac6447f2d63914fb760c44a3b19c44eaf",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216829868631721220236130764009917159226",
"42367234864772502367756514641361259052",
"232172362918513112238152125068806268284",
"71254542691951724746404900293223714350",
"6982996531472958650788495429338758606",
"63162610007625571402144820155316132484",
"227576570739040412250470208258886655925",
"224772022315347818354304673816783578550",
"101764375861745711669362260634314830028",
"149877513833818077350949956901431141382",
"201398068586773800303963951886266888234",
"300891304781371840933364517128956076075",
"28830909656863080889315129221040206337"
]
},
"deprecated": false,
"id": "CVE-2024-49854-d9848448",
"target": {
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63a07379fdb6c72450cb05294461c6016b8b7726",
"signature_version": "v1"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"80673243509769431810399986092208903920",
"42367234864772502367756514641361259052",
"232172362918513112238152125068806268284",
"232544867015414797001560673255744230654",
"155261162094914207004409952778153830138",
"205105403042652145554685807580824216066",
"233479774908288639812597891410665500989",
"224772022315347818354304673816783578550",
"101764375861745711669362260634314830028",
"149877513833818077350949956901431141382",
"201398068586773800303963951886266888234",
"300891304781371840933364517128956076075",
"28830909656863080889315129221040206337"
]
},
"deprecated": false,
"id": "CVE-2024-49854-ed94f024",
"target": {
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b8bda0ff17156cd3f60944527c9d8c9f99f1583",
"signature_version": "v1"
}
]