CVE-2024-56772

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56772
In the Linux kernel, the following vulnerability has been resolved: kunit: string-stream: Fix a UAF bug in kunit_init_suite() In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the kunit_suite_for_each_test_case() loop, the "suite->log = stream" has assigned before, and the error path only free the suite->log's stream memory but not set it to NULL, so the later string_stream_clear() of suite->log in kunit_init_suite() will cause below UAF bug. Set stream pointer to NULL after free to fix it. Unable to handle kernel paging request at virtual address 006440150000030d Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [006440150000030d] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: iio_test_gts industrialio_gts_helper cfg80211 rfkill ipv6 [last unloaded: iio_test_gts] CPU: 5 UID: 0 PID: 6253 Comm: modprobe Tainted: G B W N 6.12.0-rc4+ #458 Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST Hardware name: linux,dummy-virt (DT) pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : string_stream_clear+0x54/0x1ac lr : string_stream_clear+0x1a8/0x1ac sp : ffffffc080b47410 x29: ffffffc080b47410 x28: 006440550000030d x27: ffffff80c96b5e98 x26: ffffff80c96b5e80 x25: ffffffe461b3f6c0 x24: 0000000000000003 x23: ffffff80c96b5e88 x22: 1ffffff019cdf4fc x21: dfffffc000000000 x20: ffffff80ce6fa7e0 x19: 032202a80000186d x18: 0000000000001840 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffe45c355cb4 x14: ffffffe45c35589c x13: ffffffe45c03da78 x12: ffffffb810168e75 x11: 1ffffff810168e74 x10: ffffffb810168e74 x9 : dfffffc000000000 x8 : 0000000000000004 x7 : 0000000000000003 x6 : 0000000000000001 x5 : ffffffc080b473a0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 0000000000000001 x1 : ffffffe462fbf620 x0 : dfffffc000000000 Call trace: string_stream_clear+0x54/0x1ac __kunit_test_suites_init+0x108/0x1d8 kunit_exec_run_tests+0xb8/0x100 kunit_module_notify+0x400/0x55c notifier_call_chain+0xfc/0x3b4 blocking_notifier_call_chain+0x68/0x9c do_init_module+0x24c/0x5c8 load_module+0x4acc/0x4e90 init_module_from_file+0xd4/0x128 idempotent_init_module+0x2d4/0x57c __arm64_sys_finit_module+0xac/0x100 invoke_syscall+0x6c/0x258 el0_svc_common.constprop.0+0x160/0x22c do_el0_svc+0x44/0x5c el0_svc+0x48/0xb8 el0t_64_sync_handler+0x13c/0x158 el0t_64_sync+0x190/0x194 Code: f9400753 d2dff800 f2fbffe0 d343fe7c (38e06b80) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3213b92754b94dec6836e8b4d6ec7d224a805b61 Patch
https://git.kernel.org/stable/c/39e21403c978862846fa68b7f6d06f9cca235194 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

09 Jan 2025, 20:57

Type Values Removed Values Added
CWE CWE-416
References () https://git.kernel.org/stable/c/3213b92754b94dec6836e8b4d6ec7d224a805b61 - () https://git.kernel.org/stable/c/3213b92754b94dec6836e8b4d6ec7d224a805b61 - Patch
References () https://git.kernel.org/stable/c/39e21403c978862846fa68b7f6d06f9cca235194 - () https://git.kernel.org/stable/c/39e21403c978862846fa68b7f6d06f9cca235194 - Patch
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: kunit: string-stream: Corrige un error de UAF en kunit_init_suite() En kunit_debugfs_create_suite(), si alloc_string_stream() falla en el bucle kunit_suite_for_each_test_case(), "suite->log = stream" se ha asignado antes, y la ruta de error solo libera la memoria de flujo de suite->log pero no la establece en NULL, por lo que el posterior string_stream_clear() de suite->log en kunit_init_suite() provocará el siguiente error de UAF. Establezca el puntero de flujo en NULL después de liberarlo para solucionarlo. No se puede gestionar la solicitud de paginación del núcleo en la dirección virtual 006440150000030d Información de aborto de memoria: ESR = 0x0000000096000004 EC = 0x25: DABT (EL actual), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: error de traducción de nivel 0 Información de aborto de datos: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [006440150000030d] dirección entre los rangos de direcciones del usuario y del núcleo Error interno: Oops: 0000000096000004 [#1] PREEMPT SMP Volcado de búfer ftrace: (búfer ftrace vacío) Módulos vinculados en: iio_test_gts industrialio_gts_helper cfg80211 rfkill ipv6 [última descarga: iio_test_gts] CPU: 5 UID: 0 PID: 6253 Comm: modprobe Contaminado: GBWN 6.12.0-rc4+ #458 Contaminado: [B]=BAD_PAGE, [W]=WARN, [N]=TEST Nombre del hardware: linux,dummy-virt (DT) pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : string_stream_clear+0x54/0x1ac lr : cadena_flujo_limpio+0x1a8/0x1ac sp : ffffffc080b47410 x29: ffffffc080b47410 x28: 006440550000030d x27: ffffff80c96b5e98 x26: ffffff80c96b5e80 x25: ffffffe461b3f6c0 x24: 0000000000000003 x23: ffffff80c96b5e88 x22: 1ffffff019cdf4fc x21: dfffffc000000000 x20: ffffff80ce6fa7e0 x19: 032202a80000186d x18: 00000000000001840 x17: 0000000000000000 x16: 00000000000000000 x15: ffffffe45c355cb4 x14: ffffffe45c35589c x13: ffffffe45c03da78 x12: ffffffb810168e75 x11: 1ffffff810168e74 x10: ffffffb810168e74 x9: dfffffc000000000 x8: 000000000000004 x7: 0000000000000003 x6: 0000000000000001 x5: ffffffc080b473a0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 00000000000000001 x1 : ffffffe462fbf620 x0 : dfffffc000000000 Rastreo de llamadas: string_stream_clear+0x54/0x1ac __kunit_test_suites_init+0x108/0x1d8 kunit_exec_run_tests+0xb8/0x100 kunit_module_notify+0x400/0x55c cadena_de_llamadas_de_notificador+0xfc/0x3b4 cadena_de_llamadas_de_notificador_de_bloqueo+0x68/0x9c do_init_module+0x24c/0x5c8 módulo_carga+0x4acc/0x4e90 módulo_init_desde_archivo+0xd4/0x128 módulo_init_idempotente+0x2d4/0x57c módulo_finit_sys_arm64+0xac/0x100 llamada_al_sistema_invocada+0x6c/0x258 el0_svc_common.constprop.0+0x160/0x22c do_el0_svc+0x44/0x5c el0_svc+0x48/0xb8 controlador_sincronización_el0t_64+0x13c/0x158 el0t_64_sync+0x190/0x194 Código: f9400753 d2dff800 f2fbffe0 d343fe7c (38e06b80) ---[ fin del seguimiento 0000000000000000 ]--- Pánico del kernel: no se sincroniza: Vaya: Excepción fatal

08 Jan 2025, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-08 18:15

Updated : 2025-02-10 18:15

NVD link : CVE-2024-56772

Mitre link : CVE-2024-56772

CVE.ORG link : CVE-2024-56772

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-416

Use After Free