In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Take trace_array reference when opening options file<\/p>\n
The options files do not take the trace_array reference for the options
\nthey represent. This could cause a use-after-free kernel crash if one of
\nthese files is opened by one task and another task removes the instance
\nthat the option is for. Because it doesn’t take a reference upon opening,
\nit will not stop the removal which will free the options descriptor that
\nis being used.<\/p>\n
As the options are somewhat dynamic in their creation at boot up, each
\nfile represents a flag in the trace_array. The trace_array has an array of
\nindexes to represent each of these flags that is stored in the
\ntrace_flags_index array. The address of the index array element is used to
\npass to the inode->i_private pointer. Then that element is read which
\nholds the index (which represents the flag) and then the index is used to
\ncalculate the trace_array descriptor from its trace_flags_index array.<\/p>\n
One issue is that the index element can not be referenced until the
\ntrace_array’s reference is taken. To handle this, create a new helper
\nfunction called: trace_array_options_get() that will iterate all the
\nexisting trace_arrays in the ftrace_trace_arrays list (under the
\ntrace_types_lock), and compare the passed in address of the index element
\nwith the entire array of the trace_array’s trace_flags_index array.
\nIf it matches, then up the corresponding trace_array’s reference and
\nreturn.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tracing: Take trace_array reference when opening options file<\/p>\n
The options files do not take the trace_array reference for the opti<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24701","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}