Linux Kernel Use-After-Free Vulnerability in Block Cgroup Management

A use-after-free vulnerability has been identified in the Linux kernel's block cgroup management. This issue arises when multiple block cgroup groups (blkgs) within the same block cgroup (blkcg) are released simultaneously. The vulnerability occurs because one blkg's flush operation can inadvertently remove another blkg's I/O statistics entries, leading the second blkg to incorrectly perceive an empty list and free itself while the first blkg is still processing its entries. This flaw has been addressed by changing the timing of the flush operation, ensuring that the necessary synchronization is in place before freeing resources.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, which may be exploited to execute arbitrary code or cause a denial-of-service by crashing the system.

Reproduction

To reproduce this vulnerability, concurrently release multiple block cgroup groups within the same block cgroup. This can be done by triggering simultaneous operations that release blkgs, causing one blkg to remove another's I/O statistics entries. The second blkg will then free itself while the first is still processing, leading to a use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version can be found on the official Linux kernel website.