In the Linux kernel, the following vulnerability has been resolved:
vduse: hold vduse_lock across IDR lookup in open path
vduse_dev_open() looks up struct vduse_dev through the IDR and then
acquires dev->lock only after vduse_lock has been dropped.
This leaves a window where a concurrent VDUSE_DESTROY_DEV can remove the
same object from the IDR and free it before the open path locks the
device, leading to a use-after-free.
Close this race by keeping vduse_lock held until dev->lock has been
acquired in the open path, matching the lock ordering already used by
the destroy path.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 7
https://git.kernel.org/stable/c/35483c5306e09b3190ff937089d404a78012695c
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/5c1560be8aa6849356455af67518d35c551cbd95
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/79e12c891940b0c4c75881b7fd82a8cbb8ac97be
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/93ed4692f2299a40346025979f40e4a9b7b33af7
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a2d0a57538fd0b3b3ab75d64bb64f4cd2fab13a2
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d94e2947203aead590fd63f667d316d4475d65af
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e440e077748939839d9f76e24383b76b785f80ce
416baaa9-dc9f-4396-8d5f-8c081fb06d67