PT-2024-37003 · Linux+7 · Linux Kernel+7
Wupeng Ma
·
Published
2024-10-30
·
Updated
2025-10-03
·
CVE-2024-56693
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.0-rc3+
Description
A vulnerability in the Linux kernel has been resolved, which could cause a use-after-free (UAF) issue. The problem occurs when the
brd init function calls brd alloc before the register blkdev function succeeds, and then releases successfully created disks when brd init returns an error. This can lead to a UAF situation in certain cases. The vulnerability was discovered during fault injection testing, which revealed errors such as "unable to handle page fault for address" and "Oops" messages. The loop init function is used as a reference to fix this problem.Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix, which defers automatic disk creation until module initialization succeeds. Additionally, the
brd devices mutex has been reintroduced to help serialize modifications to the brd list. For versions prior to 6.12.0-rc3+, apply the necessary patches or updates to ensure the brd init function is modified to follow the same logic as the loop init function, and the brd devices mutex is used to prevent concurrent modifications to the brd list.Exploit
Fix
Use After Free
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu