In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing
위협 신호 · CVSS · EPSS · KEV
이론적 심각도 점수
30일 내 악용 확률 예측
실측 악용 기록 없음
별도 긴급 패치 불필요 — 정기 시스템 업그레이드 주기에 맞춰 조치
CVSS 벡터 · 메트릭
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H약점 (CWE)
- CWE-416
Use-After-Free — 해제된 메모리를 다시 사용해 충돌·코드 실행 유발.
상세 설명
In the Linux kernel, the following vulnerability has been resolved:
pps: Fix a use-after-free
On a board running ntpd and gpsd, I'm seeing a consistent use-after-free
in sys_exit() from gpsd when rebooting:
1pps pps1: removed 2------------[ cut here ]------------ 3kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being called. 4WARNING: CPU: 2 PID: 440 at lib/kobject.c:734 kobject_put+0x120/0x150 5CPU: 2 UID: 299 PID: 440 Comm: gpsd Not tainted 6.11.0-rc6-00308-gb31c44928842 #1 6Hardware name: Raspberry Pi 4 Model B Rev 1.1 (DT) 7pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) 8pc : kobject_put+0x120/0x150 9lr : kobject_put+0x120/0x15010sp : ffffffc0803d3ae011x29: ffffffc0803d3ae0 x28: ffffff8042dc9738 x27: 000000000000000112x26: 0000000000000000 x25: ffffff8042dc9040 x24: ffffff8042dc944013x23: ffffff80402a4620 x22: ffffff8042ef4bd0 x21: ffffff80405cb60014x20: 000000000008001b x19: ffffff8040b3b6e0 x18: 000000000000000015x17: 0000000000000000 x16: 0000000000000000 x15: 696e6920746f6e2016x14: 7369203a29343263 x13: 205d303434542020 x12: 000000000000000017x11: 0000000000000000 x10: 0000000000000000 x9 : 000000000000000018x8 : 0000000000000000 x7 : 0000000000000000 x6 : 000000000000000019x5 : 0000000000000000 x4 : 0000000000000000 x3 : 000000000000000020x2 : 0000000000000000 x1 : 0000000000000000 x0 : 000000000000000021Call trace:22 kobject_put+0x120/0x15023 cdev_put+0x20/0x3c24 __fput+0x2c4/0x2d825 ____fput+0x1c/0x3826 task_work_run+0x70/0xfc27 do_exit+0x2a0/0x92428 do_group_exit+0x34/0x9029 get_signal+0x7fc/0x8c030 do_signal+0x128/0x13b431 do_notify_resume+0xdc/0x16032 el0_svc+0xd4/0xf833 el0t_64_sync_handler+0x140/0x14c34 el0t_64_sync+0x190/0x19435---[ end trace 0000000000000000 ]---...followed by more symptoms of corruption, with similar stacks:
1refcount_t: underflow; use-after-free. 2kernel BUG at lib/list_debug.c:62! 3Kernel panic - not syncing: Oops - BUG: Fatal exceptionThis happens because pps_device_destruct() frees the pps_device with the
embedded cdev immediately after calling cdev_del(), but, as the comment
above cdev_del() notes, fops for previously opened cdevs are still
callable even after cdev_del() returns. I think this bug has always
been there: I can't explain why it suddenly started happening every time
I reboot this particular board.
In commit d953e0e837e6 ("pps: Fix a use-after free bug when
unregistering a source."), George Spelvin suggested removing the
embedded cdev. That seems like the simplest way to fix this, so I've
implemented his suggestion, using __register_chrdev() with pps_idr
becoming the source of truth for which minor corresponds to which
device.
But now that pps_idr defines userspace visibility instead of cdev_add(),
we need to be sure the pps->dev refcount can't reach zero while
userspace can still find it again. So, the idr_remove() call moves to
pps_unregister_cdev(), and pps_idr now holds a reference to pps->dev.
1pps_core: source serial1 got cdev (251:1) 2<...> 3pps pps1: removed 4pps_core: unregistering pps1 5pps_core: deallocating pps1AI 심층 분석
공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.
영향받는 제품·버전
- linux linux_kernel3.2.40 - 3.3linux
- linux linux_kernel3.4.87 - 3.5linux
- linux linux_kernel3.8.1 - 5.4.291linux
- linux linux_kernel5.5 - 5.10.235linux
- linux linux_kernel5.11 - 5.15.179linux
- linux linux_kernel5.16 - 6.1.129linux
- linux linux_kernel6.2 - 6.6.76linux
- linux linux_kernel6.7 - 6.12.13linux
- linux linux_kernel6.13 - 6.13.2linux
영향받는 구성 (CPE) 1
- linux linux_kernel≥ 3.2.40 < 3.3cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
참고 자료 12
링크 내용 불러오는 중…