CVE-2024-56693
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-56693
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56693.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-56693
- Downstream
- Related
- Published
- 2024-12-28T09:46:18Z
- Modified
- 2025-10-22T08:22:00.516231Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- brd: defer automatic disk creation until module initialization succeeds
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
brd: defer automatic disk creation until module initialization succeeds
My colleague Wupeng found the following problems during fault injection:
BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:_asanload8+0x4c/0xa0 ... Call Trace: <TASK> blkdevputwhole+0x41/0x70 bdevrelease+0x1a3/0x250 blkdevrelease+0x11/0x20 _fput+0x1d7/0x4a0 taskworkrun+0xfc/0x180 syscallexittousermode+0x1de/0x1f0 dosyscall64+0x6b/0x170 entrySYSCALL64after_hwframe+0x76/0x7e
loopinit() is calling loopadd() after _registerblkdev() succeeds and is ignoring diskadd() failure from loopadd(), for loopadd() failure is not fatal and successfully created disks are already visible to bdevopen().
brdinit() is currently calling brdalloc() before _registerblkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case:
case 1: T1: modprobe brd brdinit brdalloc(0) // success adddisk diskscanpartitions bdevfileopenbydev // alloc file fput // won't free until back to userspace brdalloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace _fput blkdevrelease bdevrelease blkdevputwhole bdev->bddisk->fops->release // fops is freed now, UAF!
case 2: T1: T2: modprobe brd brdinit brdalloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe
close(/dev/ram0) ... /* UAF! */ bdev->bd_disk->fops->releaseFix this problem by following what loopinit() does. Besides, reintroduce brddevicesmutex to help serialize modifications to brdlist.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/259bf925583ec9e3781df778cadf00594095090d
- https://git.kernel.org/stable/c/410896624db639500f24f46478b4bfa05c76bf56
- https://git.kernel.org/stable/c/41219c147df8bbd6591f59af5d695fb6c9a1cbff
- https://git.kernel.org/stable/c/63dfd728b30f79495dacc886127695a379805152
- https://git.kernel.org/stable/c/826cc42adf44930a633d11a5993676d85ddb0842
- https://git.kernel.org/stable/c/c0c2744cd2939ec5999c51dbaf2af16886548b7b
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7f9b348cb5e94259acdcbafbcaed55d3bb515304Fixed41219c147df8bbd6591f59af5d695fb6c9a1cbff
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7f9b348cb5e94259acdcbafbcaed55d3bb515304Fixed259bf925583ec9e3781df778cadf00594095090d
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7f9b348cb5e94259acdcbafbcaed55d3bb515304Fixed410896624db639500f24f46478b4bfa05c76bf56
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7f9b348cb5e94259acdcbafbcaed55d3bb515304Fixedc0c2744cd2939ec5999c51dbaf2af16886548b7b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7f9b348cb5e94259acdcbafbcaed55d3bb515304Fixed63dfd728b30f79495dacc886127695a379805152
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7f9b348cb5e94259acdcbafbcaed55d3bb515304Fixed826cc42adf44930a633d11a5993676d85ddb0842