High · published July 12, 2024
In the Linux kernel, the following vulnerability has been resolved:
ima: Fix use-after-free on a dentry's dname.name
->d_name.name can change on rename and the earlier value can be freed;
there are conditions sufficient to stabilize it (->d_lock on dentry,
->d_lock on its parent, ->i_rwsem exclusive on the parent's inode,
rename_lock), but none of those are met at any of the sites. Take a stable
snapshot of the name instead.
| Product | Versions | Fixed in |
|---|---|---|
| debian/debian_linux | all versions | — |
| linux/linux_kernel | ≥ 3.19, < 5.4.291 | 5.4.291 |
| linux/linux_kernel | ≥ 5.5, < 5.10.235 | 5.10.235 |
| linux/linux_kernel | ≥ 5.11, < 5.15.174 | 5.15.174 |
| linux/linux_kernel | ≥ 5.16, < 6.1.97 | 6.1.97 |
| linux/linux_kernel | ≥ 6.2, < 6.6.35 | 6.6.35 |
| linux/linux_kernel | ≥ 6.7, < 6.9.6 | 6.9.6 |