In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix use after free on unload
System crash is observed with stack trace warning of use after free. There are 2 signals to tell dpcthread to terminate (UNLOADING flag and kthreadstop).
On setting the UNLOADING flag when dpcthread happens to run at the time and sees the flag, this causes dpcthread to exit and clean up itself. When kthread_stop is called for final cleanup, this causes use after free.
Remove UNLOADING signal to terminate dpcthread. Use the kthreadstop as the main signal to exit dpc_thread.
[596663.812935] kernel BUG at mm/slub.c:294! [596663.812950] invalid opcode: 0000 [#1] SMP PTI [596663.812957] CPU: 13 PID: 1475935 Comm: rmmod Kdump: loaded Tainted: G IOE --------- - - 4.18.0-240.el8.x8664 #1 [596663.812960] Hardware name: HP ProLiant DL380p Gen8, BIOS P70 08/20/2012 [596663.812974] RIP: 0010:slabfree+0x17d/0x360
... [596663.813008] Call Trace: [596663.813022] ? _dentrykill+0x121/0x170 [596663.813030] ? condresched+0x15/0x30 [596663.813034] ? condresched+0x15/0x30 [596663.813039] ? waitforcompletion+0x35/0x190 [596663.813048] ? trytowakeup+0x63/0x540 [596663.813055] freetask+0x5a/0x60 [596663.813061] kthreadstop+0xf3/0x100 [596663.813103] qla2x00remove_one+0x284/0x440 [qla2xxx]
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 7512.0,
"function_hash": "200972355065372116149355837334914263919"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca36d9d53745d5ec8946ef85006d4da605ea7c54",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c",
"function": "qla2x00_do_dpc"
},
"id": "CVE-2024-56623-15532d76"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 7427.0,
"function_hash": "299388267907637942397719692562796594345"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07c903db0a2ff84b68efa1a74a4de353ea591eb0",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c",
"function": "qla2x00_do_dpc"
},
"id": "CVE-2024-56623-177a97cc"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"95759418447424100217360660650284102797",
"93900078240278641754124874570877597048",
"70433165177294846424542442129237401769",
"254236059271967428328917724897899902068",
"90152866493539860616273406546759779663",
"276221776401504567395731610416786357884",
"113986286650971137507244335058727055304",
"172258551665692902944541778111903964021",
"287754185540213256026502999070155853879",
"56344226862421052181984827893363923260",
"79476948694832690549731761649505563109",
"339411345353440532868783548561873052804",
"29384193901223151523591080190635472710",
"107818629781699234579732361197656091547",
"241058662175764236734236515755524478360",
"124603843267463662796254711626908797780",
"191633629983902816341778444556874356313",
"186563269487392722120324143610196083443",
"221584001830755484481079303432536405012",
"90010761636977620279217937274451862519"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@07c903db0a2ff84b68efa1a74a4de353ea591eb0",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c"
},
"id": "CVE-2024-56623-1f7e8926"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 7512.0,
"function_hash": "200972355065372116149355837334914263919"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3e6f25176f248762a24d25ab8cf8c5e90874f80",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c",
"function": "qla2x00_do_dpc"
},
"id": "CVE-2024-56623-2107a413"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 7427.0,
"function_hash": "299388267907637942397719692562796594345"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15369e774f27ec790f207de87c0b541e3f90b22d",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c",
"function": "qla2x00_do_dpc"
},
"id": "CVE-2024-56623-5092e090"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"95759418447424100217360660650284102797",
"93900078240278641754124874570877597048",
"70433165177294846424542442129237401769",
"254236059271967428328917724897899902068",
"90152866493539860616273406546759779663",
"276221776401504567395731610416786357884",
"113986286650971137507244335058727055304",
"172258551665692902944541778111903964021",
"287754185540213256026502999070155853879",
"56344226862421052181984827893363923260",
"79476948694832690549731761649505563109",
"339411345353440532868783548561873052804",
"29384193901223151523591080190635472710",
"107818629781699234579732361197656091547",
"241058662175764236734236515755524478360",
"124603843267463662796254711626908797780",
"191633629983902816341778444556874356313",
"186563269487392722120324143610196083443",
"221584001830755484481079303432536405012",
"90010761636977620279217937274451862519"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abf16d3c915b2feb68c1c8b25fcb71b13f98478",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c"
},
"id": "CVE-2024-56623-5b836651"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"95759418447424100217360660650284102797",
"93900078240278641754124874570877597048",
"70433165177294846424542442129237401769",
"254236059271967428328917724897899902068",
"90152866493539860616273406546759779663",
"276221776401504567395731610416786357884",
"113986286650971137507244335058727055304",
"172258551665692902944541778111903964021",
"287754185540213256026502999070155853879",
"56344226862421052181984827893363923260",
"79476948694832690549731761649505563109",
"339411345353440532868783548561873052804",
"29384193901223151523591080190635472710",
"107818629781699234579732361197656091547",
"241058662175764236734236515755524478360",
"124603843267463662796254711626908797780",
"191633629983902816341778444556874356313",
"186563269487392722120324143610196083443",
"221584001830755484481079303432536405012",
"90010761636977620279217937274451862519"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3e6f25176f248762a24d25ab8cf8c5e90874f80",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c"
},
"id": "CVE-2024-56623-8bbb3906"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"95759418447424100217360660650284102797",
"93900078240278641754124874570877597048",
"70433165177294846424542442129237401769",
"254236059271967428328917724897899902068",
"90152866493539860616273406546759779663",
"276221776401504567395731610416786357884",
"113986286650971137507244335058727055304",
"172258551665692902944541778111903964021",
"287754185540213256026502999070155853879",
"56344226862421052181984827893363923260",
"79476948694832690549731761649505563109",
"339411345353440532868783548561873052804",
"29384193901223151523591080190635472710",
"107818629781699234579732361197656091547",
"241058662175764236734236515755524478360",
"124603843267463662796254711626908797780",
"191633629983902816341778444556874356313",
"186563269487392722120324143610196083443",
"221584001830755484481079303432536405012",
"90010761636977620279217937274451862519"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f04fc8580eafb0510f805749553eb6213f323e",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c"
},
"id": "CVE-2024-56623-a5f476b8"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 7427.0,
"function_hash": "299388267907637942397719692562796594345"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6abf16d3c915b2feb68c1c8b25fcb71b13f98478",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c",
"function": "qla2x00_do_dpc"
},
"id": "CVE-2024-56623-ad4186da"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 7512.0,
"function_hash": "200972355065372116149355837334914263919"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@12f04fc8580eafb0510f805749553eb6213f323e",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c",
"function": "qla2x00_do_dpc"
},
"id": "CVE-2024-56623-c642d72d"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"95759418447424100217360660650284102797",
"93900078240278641754124874570877597048",
"70433165177294846424542442129237401769",
"254236059271967428328917724897899902068",
"90152866493539860616273406546759779663",
"276221776401504567395731610416786357884",
"113986286650971137507244335058727055304",
"172258551665692902944541778111903964021",
"287754185540213256026502999070155853879",
"56344226862421052181984827893363923260",
"79476948694832690549731761649505563109",
"339411345353440532868783548561873052804",
"29384193901223151523591080190635472710",
"107818629781699234579732361197656091547",
"241058662175764236734236515755524478360",
"124603843267463662796254711626908797780",
"191633629983902816341778444556874356313",
"186563269487392722120324143610196083443",
"221584001830755484481079303432536405012",
"90010761636977620279217937274451862519"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ca36d9d53745d5ec8946ef85006d4da605ea7c54",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c"
},
"id": "CVE-2024-56623-e7feb87b"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"95759418447424100217360660650284102797",
"93900078240278641754124874570877597048",
"70433165177294846424542442129237401769",
"254236059271967428328917724897899902068",
"90152866493539860616273406546759779663",
"276221776401504567395731610416786357884",
"113986286650971137507244335058727055304",
"172258551665692902944541778111903964021",
"287754185540213256026502999070155853879",
"56344226862421052181984827893363923260",
"79476948694832690549731761649505563109",
"339411345353440532868783548561873052804",
"29384193901223151523591080190635472710",
"107818629781699234579732361197656091547",
"241058662175764236734236515755524478360",
"124603843267463662796254711626908797780",
"191633629983902816341778444556874356313",
"186563269487392722120324143610196083443",
"221584001830755484481079303432536405012",
"90010761636977620279217937274451862519"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@15369e774f27ec790f207de87c0b541e3f90b22d",
"target": {
"file": "drivers/scsi/qla2xxx/qla_os.c"
},
"id": "CVE-2024-56623-f69235c3"
}
]