In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery par
위협 신호 · CVSS · EPSS · KEV
이론적 심각도 점수
예측 데이터 없음
실측 악용 기록 없음
계획된 패치 주기 내 조치(60일 이내)
CVSS 벡터 · 메트릭
CVSS 벡터 정보 없음
상세 설명
In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: Protect the recovery list during debugfs reads
Recovery participant records must remain alive while debug_state_print()
walks reco.node_data and formats their fields. The formatter holds
dlm->spinlock, but the recovery participant list is protected by
dlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches
the list under dlm_reco_state_lock and frees the detached records after
releasing it. A concurrent debugfs open can therefore read freed memory.
Protect the participant traversal and field reads in debug_state_print()
with dlm_reco_state_lock, matching the existing list writers. This also
serializes the traversal against list_add_tail() during recovery-area
initialization. Make the existing lock available to the debug code
through dlmcommon.h; the lock remains internal to the OCFS2 DLM module.
Release dlm->spinlock after formatting the other domain state and before
acquiring dlm_reco_state_lock, so the debug reader does not nest the two
locks. Leave recovery list insertion, detachment and freeing unchanged.
KASAN report as below:
1BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0 2Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896 3 4CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy) 5Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 6Call Trace: 7 <TASK> 8 dump_stack_lvl+0x93/0xd0 9 print_report+0xce/0x63010 ? debug_state_open+0x1169/0x12d011 ? srso_alias_return_thunk+0x5/0xfbef512 ? __virt_addr_valid+0x20e/0x42013 ? debug_state_open+0x1169/0x12d014 kasan_report+0xe0/0x11015 ? debug_state_open+0x1169/0x12d016 debug_state_open+0x1169/0x12d017 ? __pfx_debug_state_open+0x10/0x1018 full_proxy_open_regular+0x193/0x31019 do_dentry_open+0x595/0x12d020 ? __pfx_full_proxy_open_regular+0x10/0x1021 vfs_open_consume+0xd1/0x40022 ? srso_alias_return_thunk+0x5/0xfbef523 path_openat+0x18d0/0x202024 ? __pfx_path_openat+0x10/0x1025 do_file_open+0x21e/0x47026 ? __pfx_do_file_open+0x10/0x1027 ? _raw_spin_unlock+0x23/0x4028 ? srso_alias_return_thunk+0x5/0xfbef529 ? alloc_fd+0x3a6/0x6b030 do_sys_openat2+0xf4/0x1b031 ? __pfx_do_sys_openat2+0x10/0x1032 ? srso_alias_return_thunk+0x5/0xfbef533 ? __fput+0x5b5/0xa6034 __x64_sys_openat+0x136/0x1e035 ? __pfx___x64_sys_openat+0x10/0x1036 do_syscall_64+0x114/0x62037 entry_SYSCALL_64_after_hwframe+0x77/0x7f38[Register dump omitted.]39 </TASK>40 41Allocated by task 880:42 kasan_save_stack+0x33/0x6043 kasan_save_track+0x14/0x3044 __kasan_kmalloc+0xaa/0xb045 __kmalloc_cache_noprof+0x28d/0x61046 dlm_remaster_locks+0x147/0x1d9047 dlm_do_recovery+0xde1/0x158048 dlm_recovery_thread+0x109/0x30049 kthread+0x351/0x46050 ret_from_fork+0x659/0x94051 ret_from_fork_asm+0x1a/0x3052 53Freed by task 880:54 kasan_save_stack+0x33/0x6055 kasan_save_track+0x14/0x3056 kasan_save_free_info+0x3b/0x6057 __kasan_slab_free+0x5f/0x8058 kfree+0x308/0x58059 dlm_destroy_recovery_area+0x285/0x46060 dlm_remaster_locks+0x17c4/0x1d9061 dlm_do_recovery+0xde1/0x158062 dlm_recovery_thread+0x109/0x30063 kthread+0x351/0x46064 ret_from_fork+0x659/0x94065 ret_from_fork_asm+0x1a/0x3066 67The buggy address belongs to the object at ffff88810662ef8068 which belongs to the cache kmalloc-32 of size 3269The buggy address is located 0 bytes inside of70 freed 32-byte region [ffff88810662ef80, ffff88810662efa0)71 72[Page and memory-state dumps omitted.]AI 심층 분석
공격 시나리오 · 재현 가능한 PoC 페이로드 · 즉시 적용 가능한 차단 패치를 한 번에 받아 보세요. 보안 운영팀이 그대로 점검·티켓팅에 쓸 수 있는 형태로 정리해 드립니다.