Linux Kernel UAF Vulnerability in DM Clone Target

A use-after-free vulnerability has been identified in the Linux kernel's DM (Device Mapper) clone target, specifically in the clone_dtr() function. This vulnerability arises when the dm_resume() and dm_destroy() functions are executed concurrently, leading to a race condition. The issue has been addressed by modifying the clone_dtr() function to cancel a timer, thereby preventing the use-after-free condition.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, which may be exploited to execute arbitrary code or cause a denial-of-service condition by crashing the system.

Reproduction

The vulnerability can be reproduced by creating a scenario where the dm_resume() and dm_destroy() functions are called at the same time, causing a race condition that the use-after-free vulnerability exploits.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed.