In the Linux kernel, the following vulnerability has been resolved: md: fix mddev uaf while iterating allmddevs list While iterating allmddevs list from mdnotifyreboot() and mdexit(), listforeachentrysafe is used, and this can race with deletint the next mddev, causing UAF: t1: spinlock //listforeachentrysafe(mddev, n, ...) mddevget(mddev1) // assume mddev2 is the next entry spinunlock t2: //remove mddev2 ... mddevfree spinlock listdel spinunlock kfree(mddev2) mddevput(mddev1) spinlock //continue dereference mddev2->allmddevs The old helper foreachmddev() actually grab the reference of mddev2 while holding the lock, to prevent from being freed. This problem can be fixed the same way, however, the code will be complex. Hence switch to use listforeachentry, in this case mddevput() can free the mddev1 and it's not safe as well. Refer to mdseqshow(), also factor out a helper mddevput_locked() to fix this problem.
{ "binaries": [ { "binary_name": "bpftool", "binary_version": "7.6.0+6.14.0-22.22" }, { "binary_name": "linux-bpf-dev", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-buildinfo-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-buildinfo-6.14.0-22-generic-64k", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-cloud-tools-6.14.0-22", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-cloud-tools-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-cloud-tools-common", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-doc", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-headers-6.14.0-22", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-headers-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-headers-6.14.0-22-generic-64k", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-image-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-image-6.14.0-22-generic-dbgsym", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-image-unsigned-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-image-unsigned-6.14.0-22-generic-64k", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-image-unsigned-6.14.0-22-generic-64k-dbgsym", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-image-unsigned-6.14.0-22-generic-dbgsym", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-lib-rust-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-libc-dev", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-modules-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-modules-6.14.0-22-generic-64k", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-modules-extra-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-modules-ipu6-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-modules-ipu7-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-modules-iwlwifi-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-modules-usbio-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-modules-vision-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-perf", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-source-6.14.0", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-tools-6.14.0-22", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-tools-6.14.0-22-generic", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-tools-6.14.0-22-generic-64k", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-tools-common", "binary_version": "6.14.0-22.22" }, { "binary_name": "linux-tools-host", "binary_version": "6.14.0-22.22" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-aws-cloud-tools-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-aws-headers-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-aws-tools-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-buildinfo-6.14.0-1007-aws", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-buildinfo-6.14.0-1007-aws-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-cloud-tools-6.14.0-1007-aws", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-cloud-tools-6.14.0-1007-aws-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-headers-6.14.0-1007-aws", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-headers-6.14.0-1007-aws-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-aws", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-aws-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-aws-64k-dbgsym", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-aws-dbgsym", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-6.14.0-1007-aws", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-6.14.0-1007-aws-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-extra-6.14.0-1007-aws", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-extra-6.14.0-1007-aws-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-tools-6.14.0-1007-aws", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-tools-6.14.0-1007-aws-64k", "binary_version": "6.14.0-1007.7" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-azure-cloud-tools-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-azure-headers-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-azure-tools-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-buildinfo-6.14.0-1007-azure", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-cloud-tools-6.14.0-1007-azure", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-headers-6.14.0-1007-azure", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-azure", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-azure-dbgsym", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-6.14.0-1007-azure", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-extra-6.14.0-1007-azure", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-tools-6.14.0-1007-azure", "binary_version": "6.14.0-1007.7" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1008-gcp", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-buildinfo-6.14.0-1008-gcp-64k", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-gcp-headers-6.14.0-1008", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-gcp-tools-6.14.0-1008", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-headers-6.14.0-1008-gcp", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-headers-6.14.0-1008-gcp-64k", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-image-unsigned-6.14.0-1008-gcp", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-64k", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-64k-dbgsym", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-image-unsigned-6.14.0-1008-gcp-dbgsym", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-modules-6.14.0-1008-gcp", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-modules-6.14.0-1008-gcp-64k", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-modules-extra-6.14.0-1008-gcp", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-modules-extra-6.14.0-1008-gcp-64k", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-tools-6.14.0-1008-gcp", "binary_version": "6.14.0-1008.8" }, { "binary_name": "linux-tools-6.14.0-1008-gcp-64k", "binary_version": "6.14.0-1008.8" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1007-oracle", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-buildinfo-6.14.0-1007-oracle-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-headers-6.14.0-1007-oracle", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-headers-6.14.0-1007-oracle-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-oracle", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-64k-dbgsym", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-unsigned-6.14.0-1007-oracle-dbgsym", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-6.14.0-1007-oracle", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-6.14.0-1007-oracle-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-extra-6.14.0-1007-oracle", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-extra-6.14.0-1007-oracle-64k", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-oracle-headers-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-oracle-tools-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-tools-6.14.0-1007-oracle", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-tools-6.14.0-1007-oracle-64k", "binary_version": "6.14.0-1007.7" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1007-raspi", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-headers-6.14.0-1007-raspi", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-6.14.0-1007-raspi", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-image-6.14.0-1007-raspi-dbgsym", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-modules-6.14.0-1007-raspi", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-raspi-headers-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-raspi-tools-6.14.0-1007", "binary_version": "6.14.0-1007.7" }, { "binary_name": "linux-tools-6.14.0-1007-raspi", "binary_version": "6.14.0-1007.7" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-1004-realtime", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-cloud-tools-6.14.0-1004-realtime", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-headers-6.14.0-1004-realtime", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-image-unsigned-6.14.0-1004-realtime", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-image-unsigned-6.14.0-1004-realtime-dbgsym", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-modules-6.14.0-1004-realtime", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-modules-extra-6.14.0-1004-realtime", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-modules-iwlwifi-6.14.0-1004-realtime", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-realtime-cloud-tools-6.14.0-1004", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-realtime-headers-6.14.0-1004", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-realtime-tools-6.14.0-1004", "binary_version": "6.14.0-1004.4" }, { "binary_name": "linux-tools-6.14.0-1004-realtime", "binary_version": "6.14.0-1004.4" } ], "availability": "No subscription required" }
{ "binaries": [ { "binary_name": "linux-buildinfo-6.14.0-22-generic", "binary_version": "6.14.0-22.22.1" }, { "binary_name": "linux-headers-6.14.0-22-generic", "binary_version": "6.14.0-22.22.1" }, { "binary_name": "linux-image-6.14.0-22-generic", "binary_version": "6.14.0-22.22.1" }, { "binary_name": "linux-image-6.14.0-22-generic-dbgsym", "binary_version": "6.14.0-22.22.1" }, { "binary_name": "linux-modules-6.14.0-22-generic", "binary_version": "6.14.0-22.22.1" }, { "binary_name": "linux-riscv-headers-6.14.0-22", "binary_version": "6.14.0-22.22.1" }, { "binary_name": "linux-riscv-tools-6.14.0-22", "binary_version": "6.14.0-22.22.1" }, { "binary_name": "linux-tools-6.14.0-22-generic", "binary_version": "6.14.0-22.22.1" } ], "availability": "No subscription required" }