In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nitro_enclaves: fix use-after-free on SLOT_ALLOC failure<\/p>\n
When ne_create_vm_ioctl() fails the SLOT_ALLOC request after
\nanon_inode_getfile() has succeeded, the error path calls
\nfput(enclave_file) and then frees ne_enclave.<\/p>\n
In normal userspace context, fput() defers the final __fput() via
\ntask_work. ne_enclave_release() therefore runs after ne_enclave has
\nalready been freed and dereferences ne_enclave->slot_uid, causing a
\nuse-after-free: KASAN: slab-use-after-free in ne_enclave_release.<\/p>\n
The enclave has no slot allocated and is not yet linked into the
\nenclaves list on this error path, so ne_enclave_release() is expected
\nto return early when slot_uid is zero. However, reading slot_uid
\nalready accesses the freed object.<\/p>\n
Clear enclave_file->private_data before fput() on the error path.
\nne_enclave_release() then returns immediately when private_data is
\nNULL, leaving the ioctl error path as the sole owner of ne_enclave.
\nThis is safe because the file has not been fd_install()’d yet.<\/p>\n
Tested on an AWS EC2 m5.2xlarge with CONFIG_KASAN=y. Without the
\npatch, the reproducer triggers a KASAN slab-use-after-free on every
\nSLOT_ALLOC failure. With the patch, no KASAN report is produced and
\nthe SLOT_ALLOC error is still returned. Normal enclave creation and
\nteardown are unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nitro_enclaves: fix use-after-free on SLOT_ALLOC failure<\/p>\n
When ne_create_vm_ioctl() fails the SLOT_ALLOC request after
\nanon_inode_g<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41247","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41247","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41247"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41247"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41247"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}