In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fuse: re-lock request before replacing page cache folio<\/p>\n
fuse_try_move_folio() unlocks the request on entry but does not
\nre-lock it on the success path. This means fuse_chan_abort() can end the
\nrequest and free the fuse_io_args (eg fuse_readpages_end()) while the
\nsubsequent copy chain logic after fuse_try_move_folio() accesses the
\nfuse_io_args, leading to use-after-free issues.<\/p>\n
Fix this by calling lock_request() before replace_page_cache_folio().
\nThis ensures the request is locked on the success path which will
\nprevent the fuse_io_args from being freed while the later copying logic
\nruns, and also ensures that the ap->folios[i]->mapping is never null
\nsince ap->folios[i] will always point to the newfolio after
\nreplace_page_cache_folio().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fuse: re-lock request before replacing page cache folio<\/p>\n
fuse_try_move_folio() unlocks the request on entry but does not
\nre-lock it<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14857","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14857","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14857"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14857"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14857"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}