CVE-2024-53227: scsi: bfa: Fix use-after-free in bfad_im_module_exit()
In the Linux kernel, the following vulnerability has been resolved:
scsi: bfa: Fix use-after-free in bfadimmoduleexit()
BUG: KASAN: slab-use-after-free in lockacquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303
Call Trace: <TASK> dumpstacklvl+0x95/0xe0 printreport+0xcb/0x620 kasanreport+0xbd/0xf0 lockacquire+0x2aca/0x3a20 lockacquire+0x19b/0x520 rawspinlock+0x2b/0x40 attributecontainerunregister+0x30/0x160 fcreleasetransport+0x19/0x90 [scsitransportfc] bfadimmoduleexit+0x23/0x60 [bfa] bfadinit+0xdb/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f </TASK>
Allocated by task 25303: kasansavestack+0x24/0x50 kasansavetrack+0x14/0x30 kasankmalloc+0x7f/0x90 fcattachtransport+0x4f/0x4740 [scsitransportfc] bfadimmoduleinit+0x17/0x80 [bfa] bfadinit+0x23/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Freed by task 25303: kasansavestack+0x24/0x50 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 kasanslabfree+0x38/0x50 kfree+0x212/0x480 bfadimmoduleinit+0x7e/0x80 [bfa] bfadinit+0x23/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Above issue happens as follows:
bfadinit error = bfadimmoduleinit() fcreleasetransport(bfadimscsitransporttemplate); if (error) goto ext;
ext: bfadimmoduleexit(); fcreleasetransport(bfadimscsitransporttemplate); --> Trigger double release
Don't call bfadimmoduleexit() if bfadimmoduleinit() failed.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53227?
CVE-2024-53227 has been classified with a high severity level due to its use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2024-53227?
To fix CVE-2024-53227, it is recommended to upgrade to a patched version of the Linux kernel that resolves this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-53227?
CVE-2024-53227 affects multiple versions of the Linux kernel ranging from 2.6.32 to 6.12.x.
What are the potential impacts of CVE-2024-53227?
The potential impacts of CVE-2024-53227 include unauthorized access and remote code execution due to the use-after-free condition.
Is there a workaround for CVE-2024-53227?
There are no known effective workarounds for CVE-2024-53227; upgrading to a secure kernel version is the recommended action.