In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
configfs_lookup(): don’t leave ->s_dentry dangling on failure<\/p>\n
Normally ->s_dentry is cleared when dentry it’s pointing to becomes
\nnegative (on eviction, realistically). However, that only happens
\nif dentry gets to be positive in the first place; in case of inode
\nallocation failure dentry never becomes positive, so ->d_iput()
\nis not called at all.<\/p>\n
We do part of what normally would’ve been done by configfs_d_iput()
\n(dropping the reference to configfs_dirent) manually, but we do
\nnot clear ->s_dentry there. Sloppy as it is, it does not matter in
\ncase of configfs_create_{dir,link}() – there configfs_dirent does
\nnot survive dropping the sole reference to it.<\/p>\n
However, for configfs_lookup() it *does* survive, with a dangling
\npointer to soon to be freed dentry sitting it its ->s_dentry.<\/p>\n
Subsequent getdents(2) in that directory will end up dereferencing
\nthat pointer in order to pick the inode number. Use after free…<\/p>\n
This is the minimal fix; the right approach is to set the linkage
\nbetween dentry and configfs_dirent only after we know that we have
\nan inode, but that takes more surgery and the bug had been there
\nsince 2006, so…<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
configfs_lookup(): don’t leave ->s_dentry dangling on failure<\/p>\n
Normally ->s_dentry is cleared when dentry it’s pointing to becomes<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7310","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7310","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7310"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7310"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7310"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}