Fedora Account System
Red Hat Associate
Red Hat Customer
A module reference acquired in the Fedora-specific FIPS extrng getrandom() path is leaked whenever import_ubuf() returns an error. This is reachable by any unprivileged user with no capabilities required. AFFECTED VERSIONS: Fedora 43 (kernel 7.1.10-100) and rawhide (7.3.0-rc0). This code does not exist in upstream — it is Fedora-authored and will not be resolved by a rebase. VULNERABLE CODE (drivers/char/random.c, post-patch): 1421 if (rng && !try_module_get(rng->owner)) ← reference acquired 1422 rng = NULL; ... 1426 if (rng) { 1427 ret = import_ubuf(ITER_DEST, ubuf, len, &iter); 1428 if (unlikely(ret)) 1429 return ret; ← LEAKS the reference 1430 ret = rng->extrng_read_iter(&iter, !!(flags & GRND_RANDOM)); 1431 module_put(rng->owner); ← only reached on success path 1432 return ret; 1433 } import_ubuf() returns -EFAULT on an invalid user buffer (confirmed in lib/iov_iter.c — access_ok() check). When it does, the function returns early at line 1429 without calling module_put(), leaking the reference acquired at line 1421. TRIGGER (unprivileged, any user): while (1) getrandom((void *)-1, 16, 0); /* returns -EFAULT each time */ Each call leaks one module reference. The FIPS RNG module's refcount increments without bound. Once the refcount is nonzero, modprobe -r, FIPS mode teardown, and kernel live-patch/update flows are permanently blocked for the life of the boot. This only activates when a FIPS RNG module has called random_register_extrng(). On systems without a registered extrng, rng is NULL and the branch is not taken. FIX: Add module_put(rng->owner) before the return at line 1429: 1428 if (unlikely(ret)) { 1429 module_put(rng->owner); 1430 return ret; 1431 } This is a one-line fix. No upstream patch exists because this code is Fedora-only. DISCOVERY METHOD: Static analysis of the Fedora kernel patch delta (patch-7.1-redhat.patch) against upstream linux-7.1.10. Reproducible: Always
Confirmed on os-build: the try_module_get() reference is dropped only on the read path; an import_ubuf() failure returns with it held. Fix as you proposed, with your Reported-by/Suggested-by: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/4727 (module_put() on the failure path; RHEL-only code, applies as-is to fedora-7.1 and fedora-7.2). Scope note: nothing in-tree calls random_register_extrng(), so on a stock Fedora kernel rng is always NULL and this path is never taken; the exposure is the out-of-tree RHEL FIPS provider.
FWIW it was merged into the fedora-7.1 and fedora-7.2 branches - https://gitlab.com/cki-project/kernel-ark/-/commit/2efed24569953e88ce1f9a6ed579a71bafece833 - https://gitlab.com/cki-project/kernel-ark/-/commit/02e162bf79251e9f46e429e79eff37a4f1318f5e Afaik the kernel-ark doesn't have anything that actually would trigger this code path. As noted above, RHEL _does_ and this is being worked out in https://redhat.atlassian.net/browse/RHEL-251529. Furthermore, the work to merge into os-build is being carred out through the posted MR, https://gitlab.com/cki-project/kernel-ark/-/merge_requests/4727.
Thank you for the report and the fix, most appreciated. Yes, the extrng is used in RHEL and this is a valid bug report for these. I'll work on bringing the fix into RHEL, thanks a ton.
FEDORA-2026-a7b1ccd14c (kernel-7.1.13-100.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-a7b1ccd14c
FEDORA-2026-0d885c0533 (kernel-7.1.13-200.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d885c0533
FEDORA-2026-0d885c0533 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-0d885c0533` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d885c0533 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-a7b1ccd14c has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a7b1ccd14c` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a7b1ccd14c See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-0d885c0533 (kernel-7.1.13-200.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-a7b1ccd14c (kernel-7.1.13-100.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.