High · published June 19, 2024
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix use-after-free of timer for log writer thread
Patch series "nilfs2: fix log writer related issues".
This bug fix series covers three nilfs2 log writer-related issues,
including a timer use-after-free issue and potential deadlock issue on
unmount, and a potential freeze issue in event synchronization found
during their analysis. Details are described in each commit log.
This patch (of 3):
A use-after-free issue has been reported regarding the timer sc_timer on
the nilfs_sc_info structure.
The problem is that even though it is used to wake up a sleeping log
writer thread, sc_timer is not shut down until the nilfs_sc_info structure
is about to be freed, and is used regardless of the thread's lifetime.
Fix this issue by limiting the use of sc_timer only while the log writer
thread is alive.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.35, < 4.19.316 | 4.19.316 |
| linux/linux_kernel | ≥ 4.20, < 5.4.278 | 5.4.278 |
| linux/linux_kernel | ≥ 5.5, < 5.10.219 | 5.10.219 |
| linux/linux_kernel | ≥ 5.11, < 5.15.161 | 5.15.161 |
| linux/linux_kernel | ≥ 5.16, < 6.1.94 | 6.1.94 |
| linux/linux_kernel | ≥ 6.2, < 6.6.33 | 6.6.33 |
| linux/linux_kernel | ≥ 6.7, < 6.8.12 | 6.8.12 |
| linux/linux_kernel | ≥ 6.9, < 6.9.3 | 6.9.3 |