CVE-2024-56772: kunit: string-stream: Fix a UAF bug in kunit_init_suite()
In the Linux kernel, the following vulnerability has been resolved:
kunit: string-stream: Fix a UAF bug in kunitinitsuite()
In kunitdebugfscreatesuite(), if allocstringstream() fails in the kunitsuiteforeachtestcase() loop, the "suite->log = stream" has assigned before, and the error path only free the suite->log's stream memory but not set it to NULL, so the later stringstreamclear() of suite->log in kunitinitsuite() will cause below UAF bug.
Set stream pointer to NULL after free to fix it.
Unable to handle kernel paging request at virtual address 006440150000030d Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [006440150000030d] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: iiotestgts industrialiogtshelper cfg80211 rfkill ipv6 [last unloaded: iiotestgts] CPU: 5 UID: 0 PID: 6253 Comm: modprobe Tainted: G B W N 6.12.0-rc4+ #458 Tainted: [B]=BADPAGE, [W]=WARN, [N]=TEST Hardware name: linux,dummy-virt (DT) pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : stringstreamclear+0x54/0x1ac lr : stringstreamclear+0x1a8/0x1ac sp : ffffffc080b47410 x29: ffffffc080b47410 x28: 006440550000030d x27: ffffff80c96b5e98 x26: ffffff80c96b5e80 x25: ffffffe461b3f6c0 x24: 0000000000000003 x23: ffffff80c96b5e88 x22: 1ffffff019cdf4fc x21: dfffffc000000000 x20: ffffff80ce6fa7e0 x19: 032202a80000186d x18: 0000000000001840 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffe45c355cb4 x14: ffffffe45c35589c x13: ffffffe45c03da78 x12: ffffffb810168e75 x11: 1ffffff810168e74 x10: ffffffb810168e74 x9 : dfffffc000000000 x8 : 0000000000000004 x7 : 0000000000000003 x6 : 0000000000000001 x5 : ffffffc080b473a0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffffffe462fbf620 x0 : dfffffc000000000 Call trace: stringstreamclear+0x54/0x1ac kunittestsuitesinit+0x108/0x1d8 kunitexecruntests+0xb8/0x100 kunitmodulenotify+0x400/0x55c notifiercallchain+0xfc/0x3b4 blockingnotifiercallchain+0x68/0x9c doinitmodule+0x24c/0x5c8 loadmodule+0x4acc/0x4e90 initmodulefromfile+0xd4/0x128 idempotentinitmodule+0x2d4/0x57c arm64sysfinitmodule+0xac/0x100 invokesyscall+0x6c/0x258 el0svccommon.constprop.0+0x160/0x22c doel0svc+0x44/0x5c el0svc+0x48/0xb8 el0t64synchandler+0x13c/0x158 el0t64sync+0x190/0x194 Code: f9400753 d2dff800 f2fbffe0 d343fe7c (38e06b80) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56772?
CVE-2024-56772 has been rated as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-56772?
To fix CVE-2024-56772, update the Linux kernel to version 6.12.5 or later.
What versions of the Linux kernel are affected by CVE-2024-56772?
CVE-2024-56772 affects the Linux kernel versions 6.7 to 6.12.4.
What type of vulnerability is CVE-2024-56772?
CVE-2024-56772 is a use-after-free (UAF) vulnerability in the Linux kernel.
Where does CVE-2024-56772 occur?
CVE-2024-56772 occurs in the kunit_debugfs_create_suite() function of the Linux kernel.