Linux Kernel Proc Subsystem Use-After-Free Vulnerability in Lseek Handling

A use-after-free vulnerability has been addressed in the Linux kernel's proc subsystem. The issue arose because the proc_lseek operation was not properly validated, potentially leading to a use-after-free condition during module removal. This vulnerability was introduced in version 5.10 and exists in the stable branch through 6.4. The problem was identified as a gap in the proc_reg_open function, following a previous fix for a related use-after-free issue in proc_get_inode.

Impact

Exploitation of this vulnerability could lead to a use-after-free condition, which may be exploited to execute arbitrary code or cause a denial-of-service.

Reproduction

The vulnerability can be reproduced by creating a proc file system entry that includes a custom proc_lseek operation. If the entry is then removed while it is being accessed, the lack of proper validation can lead to a use-after-free condition.

Remediation

Users can upgrade to the latest stable version of the Linux kernel to address this vulnerability.