Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req When fuse_resend() moves a request from fpq->processing back to fiq->pending, it sets FR_PENDING and clears FR_SENT but does not remove the requests intr_entry from fiq->interrupts. If the request had FR_INTERRUPTED set from a prior signal, intr_entry remains dangling on fiq->interrupts. When the requesting task then receives a fatal signal, fuse_remove_pending_req() sees FR_PENDING=1, removes the request from fiq->pending and frees it via the refcount path, also without cleaning intr_entry. The stale intr_entry causes use-after-free when fuse_read_interrupt() iterates fiq->interrupts: - list_del_init(&req->intr_entry) -> UAF write on freed slab - req->in.h.unique -> UAF read, data leaked to userspace Remove intr_entry from fiq->interrupts in fuse_resend() for interrupted requests before they are placed back on fiq->pending. Add a WARN_ON if the intr_entry is not empty on request destruction.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 760eac73f9f69aa28fcb3050b4946c2dcc656d12 before 1d8ecd0cd696a5df0b2f72046a4ccee5d2a8ec2c; affected 760eac73f9f69aa28fcb3050b4946c2dcc656d12 before 7366e6f4d2b4c7002b13fb01219e83679dad4127; affected 760eac73f9f69aa28fcb3050b4946c2dcc656d12 before 893479015cb6442fd389d3b553ab3036c9541715; affected 760eac73f9f69aa28fcb3050b4946c2dcc656d12 before f8fce75fedf73ac72aa09163deb8f4291fdcaad2 |
| Linux / Linux | affected 6.9; unaffected 0 before 6.9; unaffected 6.12.96 through 6.12.*; unaffected 6.18.39 through 6.18.*; unaffected 7.1.4 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.