In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: f_fs: Fix Use-After-Free in AIO error path<\/p>\n
In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io()
\nfails with an error other than -EIOCBQUEUED, the io_data structure (`p`) is
\nfreed. However, for AIO operations, the kiocb cancel function was already
\narmed and kiocb->private was set to `p`.<\/p>\n
If a concurrent cancel operation (such as sys_io_cancel()) executes after
\nffs_epfile_io() fails but before the function frees `p`, a Use-After-Free
\ncan occur when the cancellation handler accesses the freed pointer.<\/p>\n
To securely fix this race condition, we must properly un-arm the
\ncancellation. Invoking `kiocb->ki_complete()` does exactly this by
\nacquiring `ctx->ctx_lock` and safely removing the kiocb from the active
\nsequence. In doing so, it ensures that a parallel io_cancel can no longer
\ndiscover the kiocb, effectively closing the race window.<\/p>\n
We then return -EIOCBQUEUED to notify the VFS layer that the kiocb has been
\nconsumed and it should avoid attempting to complete the request again or
\ntriggering subsequent completion handlers.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: f_fs: Fix Use-After-Free in AIO error path<\/p>\n
In ffs_epfile_write_iter() and ffs_epfile_read_iter(), when ffs_epfile_io(<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24732","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24732","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24732"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24732"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24732"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}