In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rtrs: Fix use-after-free in path file creation cleanup<\/p>\n
In the error path of rtrs_srv_create_path_files(), the sysfs root folders
\nmay already have been created and srv_path->kobj may already have been
\ninitialized. If a later step fails, the cleanup currently calls
\nkobject_put(&srv_path->kobj) before
\nrtrs_srv_destroy_once_sysfs_root_folders(srv_path).<\/p>\n
kobject_put() may drop the last reference to srv_path->kobj and invoke the
\nrelease callback, rtrs_srv_release(), which frees srv_path. The following
\ncall to rtrs_srv_destroy_once_sysfs_root_folders(srv_path) then
\ndereferences srv_path internally to access srv_path->srv, resulting in a
\nuse-after-free.<\/p>\n
This failure path is reached before rtrs_srv_create_path_files() returns
\nsuccess, so the successful-path lifetime handling is not involved.<\/p>\n
Fix this by destroying the sysfs root folders before calling
\nkobject_put(&srv_path->kobj), so srv_path is still valid while the helper
\naccesses it.<\/p>\n
This issue was found by a static analysis tool I am developing.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rtrs: Fix use-after-free in path file creation cleanup<\/p>\n
In the error path of rtrs_srv_create_path_files(), the sysfs root fold<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15025","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15025","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15025"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15025"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15025"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}