Bug 2176140 (CVE-2023-1252) - CVE-2023-1252 kernel: ovl: fix use after free in struct ovl_aio_req
Summary: CVE-2023-1252 kernel: ovl: fix use after free in struct ovl_aio_req
Keywords:
Status: NEW
Alias: CVE-2023-1252
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2176141 2176159 2176160 2176161 2176162
Blocks: 2156315
TreeView+ depends on / blocked
 
Reported: 2023-03-07 13:55 UTC by Alex
Modified: 2025-06-02 15:27 UTC (History)
36 users (show)

Fixed In Version: Linux kernel 5.16-rc1
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2023:6835 0 None None None 2023-11-09 07:10:50 UTC
Red Hat Product Errata RHBA-2023:7268 0 None None None 2023-11-15 18:25:20 UTC
Red Hat Product Errata RHBA-2023:7328 0 None None None 2023-11-16 11:38:51 UTC
Red Hat Product Errata RHBA-2023:7338 0 None None None 2023-11-16 18:04:11 UTC
Red Hat Product Errata RHBA-2023:7343 0 None None None 2023-11-20 01:58:39 UTC
Red Hat Product Errata RHBA-2023:7346 0 None None None 2023-11-20 09:25:40 UTC
Red Hat Product Errata RHSA-2023:6583 0 None None None 2023-11-07 08:20:16 UTC
Red Hat Product Errata RHSA-2023:6901 0 None None None 2023-11-14 15:15:03 UTC
Red Hat Product Errata RHSA-2023:7077 0 None None None 2023-11-14 15:20:38 UTC
Red Hat Product Errata RHSA-2024:0724 0 None None None 2024-02-07 16:30:00 UTC
Red Hat Product Errata RHSA-2024:8107 0 None None None 2024-10-15 00:35:27 UTC
Red Hat Product Errata RHSA-2024:8613 0 None None None 2024-10-30 00:31:51 UTC
Red Hat Product Errata RHSA-2024:8614 0 None None None 2024-10-30 00:12:39 UTC

Description Alex 2023-03-07 13:55:31 UTC 
A flaw found in the Linux Kernel. For the Ext4 file system if overlay FS being used, use after free could happen as result of the race condition. The bug actual if patch 9a2544037600 not applied yet. Example for triggering in a overlay on ext4 setup:

aio_read
  ovl_read_iter
    vfs_iter_read
      ext4_file_read_iter
        ext4_dio_read_iter
          iomap_dio_rw -> -EIOCBQUEUED
          /*
	   * Here IO is completed in a separate thread,
	   * ovl_aio_cleanup_handler() frees aio_req which has iocb embedded
	   */
          file_accessed(iocb->ki_filp); /**BOOM**/

Reference:
https://lore.kernel.org/lkml/20211115165433.449951285@linuxfoundation.org/
Comment 1 Alex 2023-03-07 13:55:59 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2176141]
Comment 4 Justin M. Forbes 2023-03-21 14:23:27 UTC 
This was fixed for Fedora with the 5.14.19 stable kernel updates.
Comment 8 errata-xmlrpc 2023-11-07 08:20:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6583 https://access.redhat.com/errata/RHSA-2023:6583
Comment 9 errata-xmlrpc 2023-11-14 15:14:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:6901 https://access.redhat.com/errata/RHSA-2023:6901
Comment 10 errata-xmlrpc 2023-11-14 15:20:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7077 https://access.redhat.com/errata/RHSA-2023:7077
Comment 13 errata-xmlrpc 2024-02-07 16:29:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0724 https://access.redhat.com/errata/RHSA-2024:0724
Comment 16 errata-xmlrpc 2024-10-15 00:35:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:8107 https://access.redhat.com/errata/RHSA-2024:8107
Comment 17 errata-xmlrpc 2024-10-30 00:12:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:8614 https://access.redhat.com/errata/RHSA-2024:8614
Comment 18 errata-xmlrpc 2024-10-30 00:31:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:8613 https://access.redhat.com/errata/RHSA-2024:8613
Note You need to log in before you can comment on or make changes to this bug.