In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dma-buf: fix UAF in dma_buf_fd() tracepoint<\/p>\n
Once FD_ADD() returns, the fd is live in the file descriptor table
\nand a thread sharing that table can close() it before DMA_BUF_TRACE()
\nruns. The close drops the last reference, __fput() frees the dma_buf,
\nand the tracepoint then dereferences dmabuf to take dmabuf->name_lock
\n— slab-use-after-free.<\/p>\n
Split FD_ADD() back into get_unused_fd_flags() + fd_install() and
\nemit the tracepoint between them. While the fdtable slot is reserved
\nwith a NULL file pointer, a racing close() returns -EBADF without
\nentering __fput(), so the dma_buf stays alive across the trace. Same
\napproach as commit 2d76319c4cbb (“dma-buf: fix UAF in dma_buf_put()
\ntracepoint”).<\/p>\n
This undoes the FD_ADD() conversion done in commit 34dfce523c90
\n(“dma: convert dma_buf_fd() to FD_ADD()”); FD_ADD() has no place to
\nhook the tracepoint safely.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dma-buf: fix UAF in dma_buf_fd() tracepoint<\/p>\n
Once FD_ADD() returns, the fd is live in the file descriptor table
\nand a thread sharin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14948","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14948","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14948"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14948"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14948"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}