In the Linux kernel, the following vulnerability has been resolved:
block, bfq: fix uaf for accessing waker_bfqq after splitting
After commit 42c306ed7233 ("block, bfq: don't break merge chain in bfqsplitbfqq()"), if the current procress is the last holder of bfqq, the bfqq can be freed after bfqsplitbfqq(). Hence recored the bfqq and then access bfqq->wakerbfqq may trigger UAF. What's more, the wakerbfqq may in the merge chain of bfqq, hence just recored waker_bfqq is still not safe.
Fix the problem by adding a helper bfqwakerbfqq() to check if bfqq->waker_bfqq is in the merge chain, and current procress is the only holder.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49854.json"
}[
{
"signature_version": "v1",
"digest": {
"length": 1694.0,
"function_hash": "289302454419313550135481882776638098086"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2024-49854-5ddd9015",
"target": {
"function": "bfq_init_rq",
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cae58d19121a70329cf971359e2518c93fec04fe"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"80673243509769431810399986092208903920",
"42367234864772502367756514641361259052",
"232172362918513112238152125068806268284",
"232544867015414797001560673255744230654",
"155261162094914207004409952778153830138",
"205105403042652145554685807580824216066",
"233479774908288639812597891410665500989",
"224772022315347818354304673816783578550",
"101764375861745711669362260634314830028",
"149877513833818077350949956901431141382",
"201398068586773800303963951886266888234",
"300891304781371840933364517128956076075",
"28830909656863080889315129221040206337"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2024-49854-962e55a0",
"target": {
"file": "block/bfq-iosched.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cae58d19121a70329cf971359e2518c93fec04fe"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-49854.json"