UBUNTU-CVE-2024-56672: Use After Free

Q: What level of access does an attacker need to exploit this issue?

The vulnerability has local attack vector and low privileges required. No user interaction is required, but exploitation requires the ability to run code locally with low-level access.

Q: Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-gkeop, ubuntu/linux-riscv, ubuntu/linux-fips, and ubuntu/linux-hwe-edge.

Q: What impact could successful exploitation have?

The severity vector indicates high impact to confidentiality, integrity, and availability. The underlying flaw is a use-after-free in blkcg_unpin_online() while walking the block cgroup hierarchy.

Published Dec 27, 2024

Updated

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcgunpinonline() blkcgunpinonline() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcgparent(blkcg) but it was calling that after blkcgdestroyblkgs(blkcg) which could free the blkcg, leading to the following UAF: ================================================================== BUG: KASAN: slab-use-after-free in blkcgunpinonline+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwbrelease cgwbreleaseworkfn Call Trace: <TASK> dumpstacklvl+0x27/0x80 printreport+0x151/0x710 kasanreport+0xc0/0x100 blkcgunpinonline+0x15a/0x270 cgwbreleaseworkfn+0x194/0x480 processscheduledworks+0x71b/0xe20 workerthread+0x82a/0xbd0 kthread+0x242/0x2c0 retfromfork+0x33/0x70 retfromforkasm+0x1a/0x30 </TASK> ... Freed by task 1944: kasansavetrack+0x2b/0x70 kasansavefreeinfo+0x3c/0x50 kasanslabfree+0x33/0x50 kfree+0x10c/0x330 cssfreerworkfn+0xe6/0xb30 processscheduledworks+0x71b/0xe20 workerthread+0x82a/0xbd0 kthread+0x242/0x2c0 retfromfork+0x33/0x70 retfromforkasm+0x1a/0x30 Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcgunpinonline(). Fix it by reading the parent pointer before destroying the blkcg's blkg's.

Affected Software

150 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.15<5.15.0-1080.87~20.04.1

5.15.0-1080.87~20.04.1

ubuntu/linux-azure-5.15<5.15.0-1082.91~20.04.1

5.15.0-1082.91~20.04.1

ubuntu/linux-gcp-5.15<5.15.0-1078.87~20.04.1

5.15.0-1078.87~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-134.145~20.04.1

5.15.0-134.145~20.04.1

ubuntu/linux-ibm-5.15<5.15.0-1074.77~20.04.1

5.15.0-1074.77~20.04.1

ubuntu/linux-intel-iotg-5.15<5.15.0-1074.80~20.04.1

5.15.0-1074.80~20.04.1

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-134.145~20.04.1

5.15.0-134.145~20.04.1

ubuntu/linux-oracle-5.15<5.15.0-1076.82~20.04.1

5.15.0-1076.82~20.04.1

ubuntu/linux-riscv-5.15<5.15.0-1074.78~20.04.1

5.15.0-1074.78~20.04.1

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1039.39~20.04.1

5.15.0-1039.39~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux<5.15.0-134.145

5.15.0-134.145

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1079.86

5.15.0-1079.86

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1027.29~22.04.1

6.8.0-1027.29~22.04.1

ubuntu/linux-azure<5.15.0-1082.91

5.15.0-1082.91

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1026.31~22.04.1

6.8.0-1026.31~22.04.1

ubuntu/linux-azure-fde<5.15.0-1082.91.1

5.15.0-1082.91.1

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-gcp<5.15.0-1078.87

5.15.0-1078.87

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1027.29~22.04.1

6.8.0-1027.29~22.04.1

ubuntu/linux-gke<5.15.0-1076.82

5.15.0-1076.82

ubuntu/linux-gkeop<5.15.0-1061.69

5.15.0-1061.69

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-57.59~22.04.1

6.8.0-57.59~22.04.1

ubuntu/linux-ibm<5.15.0-1071.74

5.15.0-1071.74

ubuntu/linux-ibm-6.8<6.8.0-1023.23~22.04.1

6.8.0-1023.23~22.04.1

ubuntu/linux-intel-iotg<5.15.0-1074.80

5.15.0-1074.80

ubuntu/linux-kvm<5.15.0-1076.81

5.15.0-1076.81

ubuntu/linux-lowlatency<5.15.0-134.145

5.15.0-134.145

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-57.59.1~22.04.1

6.8.0-57.59.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1073.74

5.15.0-1073.74

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1025.28~22.04.1

6.8.0-1025.28~22.04.1

ubuntu/linux-nvidia-tegra<5.15.0-1033.33

5.15.0-1033.33

ubuntu/linux-nvidia-tegra-igx<5.15.0-1021.21

5.15.0-1021.21

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1076.82

5.15.0-1076.82

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1023.24~22.04.1

6.8.0-1023.24~22.04.1

ubuntu/linux-raspi<5.15.0-1073.76

5.15.0-1073.76

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-57.59.1~22.04.1

6.8.0-57.59.1~22.04.1

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp<5.15.0-1044.48

5.15.0-1044.48

ubuntu/linux-bluefield<5.15.0-1061.63

5.15.0-1061.63

ubuntu/linux-intel-iot-realtime<5.15.0-1072.74

5.15.0-1072.74

ubuntu/linux-realtime<5.15.0-1079.87

5.15.0-1079.87

ubuntu/linux-realtime-6.8<6.8.1-1019.20~22.04.1

6.8.1-1019.20~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1079.86+fips1

5.15.0-1079.86+fips1

ubuntu/linux-azure-fips<5.15.0-1082.91+fips1

5.15.0-1082.91+fips1

ubuntu/linux-fips<5.15.0-134.145+fips1

5.15.0-134.145+fips1

ubuntu/linux-gcp-fips<5.15.0-1078.87+fips1

5.15.0-1078.87+fips1

ubuntu/linux<6.8.0-57.59

6.8.0-57.59

ubuntu/linux-aws<6.8.0-1026.28

6.8.0-1026.28

ubuntu/linux-azure<6.8.0-1026.31

6.8.0-1026.31

ubuntu/linux-azure-6.11<6.11.0-1012.12~24.04.1

6.11.0-1012.12~24.04.1

ubuntu/linux-azure-nvidia<6.8.0-1014.15

6.8.0-1014.15

ubuntu/linux-gcp<6.8.0-1027.29

6.8.0-1027.29

ubuntu/linux-gcp-6.11<6.11.0-1011.11~24.04.1

6.11.0-1011.11~24.04.1

ubuntu/linux-gke<6.8.0-1022.26

6.8.0-1022.26

ubuntu/linux-gkeop<6.8.0-1009.11

6.8.0-1009.11

ubuntu/linux-ibm<6.8.0-1023.23

6.8.0-1023.23

ubuntu/linux-lowlatency<6.8.0-57.59.1

6.8.0-57.59.1

ubuntu/linux-nvidia<6.8.0-1025.28

6.8.0-1025.28

ubuntu/linux-nvidia-6.11<6.11.0-1007.7

6.11.0-1007.7

ubuntu/linux-nvidia-lowlatency<6.8.0-1025.28.1

6.8.0-1025.28.1

ubuntu/linux-nvidia-tegra<6.8.0-1008.8

6.8.0-1008.8

ubuntu/linux-oem-6.11<6.11.0-1016.16

6.11.0-1016.16

ubuntu/linux-oem-6.8<6.8.0-1025.25

6.8.0-1025.25

ubuntu/linux-oracle<6.8.0-1023.24

6.8.0-1023.24

ubuntu/linux-raspi<6.8.0-1028.32

6.8.0-1028.32

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv<6.8.0-57.59.1

6.8.0-57.59.1

ubuntu/linux-xilinx<6.8.0-1017.18

6.8.0-1017.18

ubuntu/linux-raspi-realtime<6.8.0-2023.24

6.8.0-2023.24

ubuntu/linux-realtime<6.8.1-1019.20

6.8.1-1019.20

ubuntu/linux-fips<6.8.0-78.78+fips1

6.8.0-78.78+fips1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1080.87~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.91~20.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1078.87~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-134.145~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.77~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.80~20.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-134.145~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.82~20.04.1
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.78~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1039.39~20.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-134.145
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.86
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.29~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.91
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.31~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.91.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1078.87
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.29~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.82
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1061.69
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-57.59~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1071.74
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.23~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1074.80
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.81
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-134.145
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-57.59.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1073.74
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.28~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.33
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1021.21
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1076.82
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.24~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1073.76
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-57.59.1~22.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.15.0-1044.48
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1061.63
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1072.74
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.87
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1019.20~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1079.86+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1082.91+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-134.145+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1078.87+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-57.59
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.28
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1026.31
Upgrade
Upgrade ubuntu/linux-azure-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1012.12~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1014.15
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1027.29
Upgrade
Upgrade ubuntu/linux-gcp-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1011.11~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1022.26
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1009.11
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.23
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-57.59.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.28
Upgrade
Upgrade ubuntu/linux-nvidia-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1007.7
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.28.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1008.8
Upgrade
Upgrade ubuntu/linux-oem-6.11 to a version that resolves this vulnerability.
Fixed in 6.11.0-1016.16
Upgrade
Upgrade ubuntu/linux-oem-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1025.25
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1023.24
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.32
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 6.8.0-57.59.1
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1017.18
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2023.24
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1019.20
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-78.78+fips1
Compensating control
In blkcg_unpin_online(), read and save the blkcg parent pointer before calling blkcg_destroy_blkgs(blkcg), then use the saved pointer when walking up the blkcg hierarchy.

Event History

Dec 27, 2024

CVE Published

via OSV·03:15 PM

Data Sourced

via OSV·03:15 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability has local attack vector and low privileges required. No user interaction is required, but exploitation requires the ability to run code locally with low-level access.

Which Ubuntu kernel packages are identified as affected?

The listed packages are ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-gke, ubuntu/linux-gkeop, ubuntu/linux-riscv, ubuntu/linux-fips, and ubuntu/linux-hwe-edge.

What impact could successful exploitation have?

The severity vector indicates high impact to confidentiality, integrity, and availability. The underlying flaw is a use-after-free in blkcg_unpin_online() while walking the block cgroup hierarchy.

UBUNTU-CVE-2024-56672: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which Ubuntu kernel packages are identified as affected?

What impact could successful exploitation have?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which Ubuntu kernel packages are identified as affected?

What impact could successful exploitation have?