In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: make sure cache entry active before cache_show
The function c_show was called with protection from RCU. This only
ensures that cp will not be freed. Therefore, the reference count for
cp can drop to zero, which will trigger a refcount use-after-free
warning when cache_get is called. To resolve this issue, use
cache_get_rcu to ensure that cp remains active.
------------[ cut here ]------------ refcountt: addition on 0; use-after-free. WARNING: CPU: 7 PID: 822 at lib/refcount.c:25 refcountwarnsaturate+0xb1/0x120 CPU: 7 UID: 0 PID: 822 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcountwarn_saturate+0xb1/0x120
Call Trace: <TASK> cshow+0x2fc/0x380 [sunrpc] seqreaditer+0x589/0x770 seqread+0x1e5/0x270 procregread+0xe1/0x140 vfsread+0x125/0x530 ksysread+0xc1/0x160 dosyscall64+0x5f/0x170 entrySYSCALL64afterhwframe+0x76/0x7e
[
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"84261469466062246415698326479015076726",
"101700550759698393139882309523734018093",
"297738690530724433477749243087887509027",
"160723489509123040890578860655692953561"
]
},
"id": "CVE-2024-53174-069ac19c",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9be26735d055c42543a4d047a769cc6d0fb1504",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c",
"function": "c_show"
},
"digest": {
"length": 577.0,
"function_hash": "2416032901881354164801470227919298340"
},
"id": "CVE-2024-53174-101f9e82",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02999e135b013d85c6df738746e8e24699befee4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"196452337123957385103713036989832289473",
"101700550759698393139882309523734018093",
"180690607984215342990487307273006794864",
"9192536462821425615959616592947992702"
]
},
"id": "CVE-2024-53174-158119b7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d882e2b7fad3f5e5fac66184a347f408813f654a",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c",
"function": "c_show"
},
"digest": {
"length": 576.0,
"function_hash": "267602374745952834613214008931058861229"
},
"id": "CVE-2024-53174-27b86830",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e9be26735d055c42543a4d047a769cc6d0fb1504",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"196452337123957385103713036989832289473",
"101700550759698393139882309523734018093",
"180690607984215342990487307273006794864",
"9192536462821425615959616592947992702"
]
},
"id": "CVE-2024-53174-33918f5b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2862eee078a4d2d1f584e7f24fa50dddfa5f3471",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"196452337123957385103713036989832289473",
"101700550759698393139882309523734018093",
"180690607984215342990487307273006794864",
"9192536462821425615959616592947992702"
]
},
"id": "CVE-2024-53174-45fa6204",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec305f303bf070b4f6896b7a76009f702956d402",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"196452337123957385103713036989832289473",
"101700550759698393139882309523734018093",
"180690607984215342990487307273006794864",
"9192536462821425615959616592947992702"
]
},
"id": "CVE-2024-53174-598fc90f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acfaf37888e0f0732fb6a50ff093dce6d99994d0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"196452337123957385103713036989832289473",
"101700550759698393139882309523734018093",
"180690607984215342990487307273006794864",
"9192536462821425615959616592947992702"
]
},
"id": "CVE-2024-53174-81185088",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@068c0b50f3f700b94f78850834cd91ae3b34c2c1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"196452337123957385103713036989832289473",
"101700550759698393139882309523734018093",
"180690607984215342990487307273006794864",
"9192536462821425615959616592947992702"
]
},
"id": "CVE-2024-53174-967bada1",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dac3af57e38b2054f990e573256d90bf887958",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"196452337123957385103713036989832289473",
"101700550759698393139882309523734018093",
"180690607984215342990487307273006794864",
"9192536462821425615959616592947992702"
]
},
"id": "CVE-2024-53174-97bba6bd",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@02999e135b013d85c6df738746e8e24699befee4",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c",
"function": "c_show"
},
"digest": {
"length": 577.0,
"function_hash": "2416032901881354164801470227919298340"
},
"id": "CVE-2024-53174-994eacd6",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@068c0b50f3f700b94f78850834cd91ae3b34c2c1",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c",
"function": "c_show"
},
"digest": {
"length": 577.0,
"function_hash": "2416032901881354164801470227919298340"
},
"id": "CVE-2024-53174-9b4e2711",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2862eee078a4d2d1f584e7f24fa50dddfa5f3471",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c",
"function": "c_show"
},
"digest": {
"length": 577.0,
"function_hash": "2416032901881354164801470227919298340"
},
"id": "CVE-2024-53174-bf8b6f25",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec305f303bf070b4f6896b7a76009f702956d402",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c",
"function": "c_show"
},
"digest": {
"length": 577.0,
"function_hash": "2416032901881354164801470227919298340"
},
"id": "CVE-2024-53174-da127fe9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d882e2b7fad3f5e5fac66184a347f408813f654a",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c",
"function": "c_show"
},
"digest": {
"length": 577.0,
"function_hash": "2416032901881354164801470227919298340"
},
"id": "CVE-2024-53174-daa58d31",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7dac3af57e38b2054f990e573256d90bf887958",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "net/sunrpc/cache.c",
"function": "c_show"
},
"digest": {
"length": 577.0,
"function_hash": "2416032901881354164801470227919298340"
},
"id": "CVE-2024-53174-dcb9e6d9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@acfaf37888e0f0732fb6a50ff093dce6d99994d0",
"signature_version": "v1"
}
]