Linux Kernel RDMA/rtrs Use-After-Free Vulnerability in Path File Creation Cleanup

A use-after-free vulnerability has been identified in the Linux kernel's RDMA/rtrs component. This issue arises during the path file creation process, specifically within the 'rtrs_srv_create_path_files()' function'. When an error occurs after the sysfs root folders have been created and the 'srv_path->kobj' object has been initialized, the current cleanup process inadvertently drops the last reference to 'srv_path->kobj'. This premature release allows 'srv_path' to be freed while it is still being accessed, leading to a use-after-free condition. The vulnerability affects several versions of the Linux kernel.

Impact

Exploitation of this vulnerability causes a use-after-free condition, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

To reproduce this vulnerability, create a scenario where 'rtrs_srv_create_path_files()' is called and an error occurs after the sysfs root folders have been created but before the function completes successfully. This will trigger the cleanup process that improperly manages the 'srv_path->kobj' reference, causing the use-after-free condition.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. Instructions for downloading the updated kernel can be found on the official Linux kernel website.