In the Linux kernel, the following vulnerability has been resolved:
scsi: bfa: Fix use-after-free in bfadimmodule_exit()
BUG: KASAN: slab-use-after-free in _lockacquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303
Call Trace: <TASK> dumpstacklvl+0x95/0xe0 printreport+0xcb/0x620 kasanreport+0xbd/0xf0 _lockacquire+0x2aca/0x3a20 lockacquire+0x19b/0x520 _rawspinlock+0x2b/0x40 attributecontainerunregister+0x30/0x160 fcreleasetransport+0x19/0x90 [scsitransportfc] bfadimmoduleexit+0x23/0x60 [bfa] bfadinit+0xdb/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64after_hwframe+0x77/0x7f </TASK>
Allocated by task 25303: kasansavestack+0x24/0x50 kasansavetrack+0x14/0x30 _kasankmalloc+0x7f/0x90 fcattachtransport+0x4f/0x4740 [scsitransportfc] bfadimmoduleinit+0x17/0x80 [bfa] bfadinit+0x23/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Freed by task 25303: kasansavestack+0x24/0x50 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 _kasanslabfree+0x38/0x50 kfree+0x212/0x480 bfadimmoduleinit+0x7e/0x80 [bfa] bfadinit+0x23/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Above issue happens as follows:
bfadinit error = bfadimmoduleinit() fcreleasetransport(bfadimscsitransporttemplate); if (error) goto ext;
ext: bfadimmoduleexit(); fcreleasetransport(bfadimscsitransport_template); --> Trigger double release
Don't call bfadimmoduleexit() if bfadimmoduleinit() failed.
[
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 678.0,
"function_hash": "196588029403589259734291520644793483158"
},
"id": "CVE-2024-53227-12b68364",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ffdde30a90bf8efe8f270407f486706962b3292",
"target": {
"file": "drivers/scsi/bfa/bfad.c",
"function": "bfad_init"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 678.0,
"function_hash": "196588029403589259734291520644793483158"
},
"id": "CVE-2024-53227-1796d48e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@178b8f38932d635e90f5f0e9af1986c6f4a89271",
"target": {
"file": "drivers/scsi/bfa/bfad.c",
"function": "bfad_init"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 678.0,
"function_hash": "196588029403589259734291520644793483158"
},
"id": "CVE-2024-53227-2550d02f",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ceac8012d3ddea3317f0d82934293d05feb8af1",
"target": {
"file": "drivers/scsi/bfa/bfad.c",
"function": "bfad_init"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315832450596662804707028990158580232551",
"279313066969052828007081287934722219003",
"48638581916104019220485774677578230374",
"58330184285469569966602281560453205178",
"174395251798415400757569704573740103011",
"231445225612007275837321810568876738692"
]
},
"id": "CVE-2024-53227-34bded91",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef2c2580189ea88a0dcaf56eb3a565763a900edb",
"target": {
"file": "drivers/scsi/bfa/bfad.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315832450596662804707028990158580232551",
"279313066969052828007081287934722219003",
"48638581916104019220485774677578230374",
"58330184285469569966602281560453205178",
"174395251798415400757569704573740103011",
"231445225612007275837321810568876738692"
]
},
"id": "CVE-2024-53227-35573a88",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@178b8f38932d635e90f5f0e9af1986c6f4a89271",
"target": {
"file": "drivers/scsi/bfa/bfad.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315832450596662804707028990158580232551",
"279313066969052828007081287934722219003",
"48638581916104019220485774677578230374",
"58330184285469569966602281560453205178",
"174395251798415400757569704573740103011",
"231445225612007275837321810568876738692"
]
},
"id": "CVE-2024-53227-4c8a4531",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ffdde30a90bf8efe8f270407f486706962b3292",
"target": {
"file": "drivers/scsi/bfa/bfad.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 678.0,
"function_hash": "196588029403589259734291520644793483158"
},
"id": "CVE-2024-53227-70299074",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f5a97443b547b4c83f876f1d6a11df0f1fd4efb",
"target": {
"file": "drivers/scsi/bfa/bfad.c",
"function": "bfad_init"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315832450596662804707028990158580232551",
"279313066969052828007081287934722219003",
"48638581916104019220485774677578230374",
"58330184285469569966602281560453205178",
"174395251798415400757569704573740103011",
"231445225612007275837321810568876738692"
]
},
"id": "CVE-2024-53227-9273cbd8",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e76181a5be90abcc3ed8a300bd13878aa214d022",
"target": {
"file": "drivers/scsi/bfa/bfad.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 678.0,
"function_hash": "196588029403589259734291520644793483158"
},
"id": "CVE-2024-53227-953a29c7",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3932c753f805a02e9364a4c58b590f21901f8490",
"target": {
"file": "drivers/scsi/bfa/bfad.c",
"function": "bfad_init"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 678.0,
"function_hash": "196588029403589259734291520644793483158"
},
"id": "CVE-2024-53227-a1af69c9",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28409f851abd93b37969cac7498828ad533afd9",
"target": {
"file": "drivers/scsi/bfa/bfad.c",
"function": "bfad_init"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 678.0,
"function_hash": "196588029403589259734291520644793483158"
},
"id": "CVE-2024-53227-a5d34a00",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e76181a5be90abcc3ed8a300bd13878aa214d022",
"target": {
"file": "drivers/scsi/bfa/bfad.c",
"function": "bfad_init"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315832450596662804707028990158580232551",
"279313066969052828007081287934722219003",
"48638581916104019220485774677578230374",
"58330184285469569966602281560453205178",
"174395251798415400757569704573740103011",
"231445225612007275837321810568876738692"
]
},
"id": "CVE-2024-53227-afef7e88",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0ceac8012d3ddea3317f0d82934293d05feb8af1",
"target": {
"file": "drivers/scsi/bfa/bfad.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 678.0,
"function_hash": "196588029403589259734291520644793483158"
},
"id": "CVE-2024-53227-c0bd97d0",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef2c2580189ea88a0dcaf56eb3a565763a900edb",
"target": {
"file": "drivers/scsi/bfa/bfad.c",
"function": "bfad_init"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315832450596662804707028990158580232551",
"279313066969052828007081287934722219003",
"48638581916104019220485774677578230374",
"58330184285469569966602281560453205178",
"174395251798415400757569704573740103011",
"231445225612007275837321810568876738692"
]
},
"id": "CVE-2024-53227-c6826dae",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c28409f851abd93b37969cac7498828ad533afd9",
"target": {
"file": "drivers/scsi/bfa/bfad.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315832450596662804707028990158580232551",
"279313066969052828007081287934722219003",
"48638581916104019220485774677578230374",
"58330184285469569966602281560453205178",
"174395251798415400757569704573740103011",
"231445225612007275837321810568876738692"
]
},
"id": "CVE-2024-53227-d956cef2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3932c753f805a02e9364a4c58b590f21901f8490",
"target": {
"file": "drivers/scsi/bfa/bfad.c"
}
},
{
"deprecated": false,
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"315832450596662804707028990158580232551",
"279313066969052828007081287934722219003",
"48638581916104019220485774677578230374",
"58330184285469569966602281560453205178",
"174395251798415400757569704573740103011",
"231445225612007275837321810568876738692"
]
},
"id": "CVE-2024-53227-ddd2090d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8f5a97443b547b4c83f876f1d6a11df0f1fd4efb",
"target": {
"file": "drivers/scsi/bfa/bfad.c"
}
}
]