In the Linux kernel, the following vulnerability has been resolved:
brd: defer automatic disk creation until module initialization succeeds
My colleague Wupeng found the following problems during fault injection:
BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:_asanload8+0x4c/0xa0 ... Call Trace: <TASK> blkdevputwhole+0x41/0x70 bdevrelease+0x1a3/0x250 blkdevrelease+0x11/0x20 _fput+0x1d7/0x4a0 taskworkrun+0xfc/0x180 syscallexittousermode+0x1de/0x1f0 dosyscall64+0x6b/0x170 entrySYSCALL64after_hwframe+0x76/0x7e
loopinit() is calling loopadd() after _registerblkdev() succeeds and is ignoring diskadd() failure from loopadd(), for loopadd() failure is not fatal and successfully created disks are already visible to bdevopen().
brdinit() is currently calling brdalloc() before _registerblkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case:
case 1: T1: modprobe brd brdinit brdalloc(0) // success adddisk diskscanpartitions bdevfileopenbydev // alloc file fput // won't free until back to userspace brdalloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace _fput blkdevrelease bdevrelease blkdevputwhole bdev->bddisk->fops->release // fops is freed now, UAF!
case 2: T1: T2: modprobe brd brdinit brdalloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe
                               close(/dev/ram0)
                               ...
                               /* UAF! */
                               bdev->bd_disk->fops->release
Fix this problem by following what loopinit() does. Besides, reintroduce brddevicesmutex to help serialize modifications to brdlist.
[
    {
        "id": "CVE-2024-56693-02ca3da0",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_init"
        },
        "digest": {
            "function_hash": "65140280053406527188974264111098167856",
            "length": 445.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41219c147df8bbd6591f59af5d695fb6c9a1cbff"
    },
    {
        "id": "CVE-2024-56693-09204008",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_alloc"
        },
        "digest": {
            "function_hash": "238124805543385184683515901400989636266",
            "length": 1354.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c2744cd2939ec5999c51dbaf2af16886548b7b"
    },
    {
        "id": "CVE-2024-56693-18c2082a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_alloc"
        },
        "digest": {
            "function_hash": "48935281472839478486018644330317846278",
            "length": 1284.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@410896624db639500f24f46478b4bfa05c76bf56"
    },
    {
        "id": "CVE-2024-56693-3cee1d5a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/brd.c"
        },
        "digest": {
            "line_hashes": [
                "167224533772432193008316555342371580178",
                "339213803085541172880106363022359670147",
                "73638543936352703445541655918874719808",
                "86269134029727627044141614043848787539",
                "314214658450402851364575045042444757158",
                "195957888660640820982583982417620583640",
                "201004780499497687503038011528112314005",
                "184735545834128588787000932663297101580",
                "42361002176123089840230871615371338794",
                "322412742999700146341329593384104462678",
                "236203738220855827237921676524864357252",
                "146145900945631291609906173426009574007",
                "203054768154913937221302070546025096229",
                "278949759076762810842953497447872218105",
                "149017020530981294840697200701697182730",
                "182665697741799319216033439472774283848",
                "51219156519668754218103709679593345532",
                "187687607664120381348397860247147786498",
                "163346840329393864484824081130661544723",
                "332941848559468841127502489652549157710",
                "63991325242501749753502151284894772131",
                "245982459171805043840661858352615641612",
                "123597226273309555525131709872457912035",
                "174262405678901597965572057314051145074",
                "63195531825585511680259221346326203534",
                "225537174062866932708287016206592370210",
                "77432895895069495674507478289446219257",
                "220661227085869502072308561973867904540",
                "14155418208764675878058523625915495048",
                "104310210228786370072723765574840903299",
                "275814167991443231315170667712118859644",
                "203673631734786624153529062367594416072",
                "210319942999459689072576913891580572980",
                "42971500172745161905769553781579969052",
                "69926012569298369209690196407489035805",
                "205802693436619835544000030877634818336",
                "60794532626564041531087166356997271471",
                "64113835251644701234544680570523160644",
                "143770093516563300388833877129314686878",
                "146397145218599905808038578468711902788"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@259bf925583ec9e3781df778cadf00594095090d"
    },
    {
        "id": "CVE-2024-56693-3f1a59bb",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_alloc"
        },
        "digest": {
            "function_hash": "21601300339180363068592846896010947166",
            "length": 1364.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41219c147df8bbd6591f59af5d695fb6c9a1cbff"
    },
    {
        "id": "CVE-2024-56693-41ad756d",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_init"
        },
        "digest": {
            "function_hash": "65140280053406527188974264111098167856",
            "length": 445.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c2744cd2939ec5999c51dbaf2af16886548b7b"
    },
    {
        "id": "CVE-2024-56693-48828b06",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_init"
        },
        "digest": {
            "function_hash": "65140280053406527188974264111098167856",
            "length": 445.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@259bf925583ec9e3781df778cadf00594095090d"
    },
    {
        "id": "CVE-2024-56693-4f7a734d",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_init"
        },
        "digest": {
            "function_hash": "65140280053406527188974264111098167856",
            "length": 445.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@410896624db639500f24f46478b4bfa05c76bf56"
    },
    {
        "id": "CVE-2024-56693-5fe02a92",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_alloc"
        },
        "digest": {
            "function_hash": "238124805543385184683515901400989636266",
            "length": 1354.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63dfd728b30f79495dacc886127695a379805152"
    },
    {
        "id": "CVE-2024-56693-6b085040",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_alloc"
        },
        "digest": {
            "function_hash": "231204760986517580368517483529580236770",
            "length": 1329.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@259bf925583ec9e3781df778cadf00594095090d"
    },
    {
        "id": "CVE-2024-56693-6eced59a",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_cleanup"
        },
        "digest": {
            "function_hash": "153480907109585049239168789125081008507",
            "length": 291.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@259bf925583ec9e3781df778cadf00594095090d"
    },
    {
        "id": "CVE-2024-56693-767975d0",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/brd.c"
        },
        "digest": {
            "line_hashes": [
                "167224533772432193008316555342371580178",
                "339213803085541172880106363022359670147",
                "73638543936352703445541655918874719808",
                "86269134029727627044141614043848787539",
                "314214658450402851364575045042444757158",
                "195957888660640820982583982417620583640",
                "201004780499497687503038011528112314005",
                "184735545834128588787000932663297101580",
                "42361002176123089840230871615371338794",
                "322412742999700146341329593384104462678",
                "236203738220855827237921676524864357252",
                "146145900945631291609906173426009574007",
                "203054768154913937221302070546025096229",
                "278949759076762810842953497447872218105",
                "149017020530981294840697200701697182730",
                "182665697741799319216033439472774283848",
                "329305593120029419131543759885545634192",
                "310611609190175482302961601232493843341",
                "163346840329393864484824081130661544723",
                "332941848559468841127502489652549157710",
                "63991325242501749753502151284894772131",
                "2532963621936672212860075786793617574",
                "182663269553803949231379575636092237324",
                "174262405678901597965572057314051145074",
                "63195531825585511680259221346326203534",
                "225537174062866932708287016206592370210",
                "77432895895069495674507478289446219257",
                "220661227085869502072308561973867904540",
                "14155418208764675878058523625915495048",
                "104310210228786370072723765574840903299",
                "275814167991443231315170667712118859644",
                "203673631734786624153529062367594416072",
                "210319942999459689072576913891580572980",
                "42971500172745161905769553781579969052",
                "69926012569298369209690196407489035805",
                "205802693436619835544000030877634818336",
                "60794532626564041531087166356997271471",
                "64113835251644701234544680570523160644",
                "143770093516563300388833877129314686878",
                "146397145218599905808038578468711902788"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41219c147df8bbd6591f59af5d695fb6c9a1cbff"
    },
    {
        "id": "CVE-2024-56693-7ec7c7c7",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_cleanup"
        },
        "digest": {
            "function_hash": "153480907109585049239168789125081008507",
            "length": 291.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c2744cd2939ec5999c51dbaf2af16886548b7b"
    },
    {
        "id": "CVE-2024-56693-85f39231",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_cleanup"
        },
        "digest": {
            "function_hash": "153480907109585049239168789125081008507",
            "length": 291.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@410896624db639500f24f46478b4bfa05c76bf56"
    },
    {
        "id": "CVE-2024-56693-9a18cb8f",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/brd.c"
        },
        "digest": {
            "line_hashes": [
                "167224533772432193008316555342371580178",
                "339213803085541172880106363022359670147",
                "73638543936352703445541655918874719808",
                "86269134029727627044141614043848787539",
                "314214658450402851364575045042444757158",
                "270092075887499403731768901727455087391",
                "207402774889717203165776076478133946253",
                "302647119578513523092651447829443730705",
                "42361002176123089840230871615371338794",
                "322412742999700146341329593384104462678",
                "236203738220855827237921676524864357252",
                "146145900945631291609906173426009574007",
                "203054768154913937221302070546025096229",
                "3086429918230642589898985063622248084",
                "70949265446472049752484878354669277113",
                "257865092388941991244234566772367028408",
                "51219156519668754218103709679593345532",
                "187687607664120381348397860247147786498",
                "163346840329393864484824081130661544723",
                "332941848559468841127502489652549157710",
                "63991325242501749753502151284894772131",
                "245982459171805043840661858352615641612",
                "123597226273309555525131709872457912035",
                "174262405678901597965572057314051145074",
                "63195531825585511680259221346326203534",
                "225537174062866932708287016206592370210",
                "77432895895069495674507478289446219257",
                "220661227085869502072308561973867904540",
                "14155418208764675878058523625915495048",
                "104310210228786370072723765574840903299",
                "275814167991443231315170667712118859644",
                "203673631734786624153529062367594416072",
                "210319942999459689072576913891580572980",
                "42971500172745161905769553781579969052",
                "69926012569298369209690196407489035805",
                "205802693436619835544000030877634818336",
                "60794532626564041531087166356997271471",
                "64113835251644701234544680570523160644",
                "143770093516563300388833877129314686878",
                "146397145218599905808038578468711902788"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63dfd728b30f79495dacc886127695a379805152"
    },
    {
        "id": "CVE-2024-56693-acc63466",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/brd.c"
        },
        "digest": {
            "line_hashes": [
                "167224533772432193008316555342371580178",
                "339213803085541172880106363022359670147",
                "73638543936352703445541655918874719808",
                "86269134029727627044141614043848787539",
                "314214658450402851364575045042444757158",
                "195957888660640820982583982417620583640",
                "201004780499497687503038011528112314005",
                "184735545834128588787000932663297101580",
                "42361002176123089840230871615371338794",
                "322412742999700146341329593384104462678",
                "236203738220855827237921676524864357252",
                "146145900945631291609906173426009574007",
                "203054768154913937221302070546025096229",
                "3086429918230642589898985063622248084",
                "70949265446472049752484878354669277113",
                "257865092388941991244234566772367028408",
                "51219156519668754218103709679593345532",
                "187687607664120381348397860247147786498",
                "163346840329393864484824081130661544723",
                "332941848559468841127502489652549157710",
                "63991325242501749753502151284894772131",
                "245982459171805043840661858352615641612",
                "123597226273309555525131709872457912035",
                "174262405678901597965572057314051145074",
                "63195531825585511680259221346326203534",
                "225537174062866932708287016206592370210",
                "77432895895069495674507478289446219257",
                "220661227085869502072308561973867904540",
                "14155418208764675878058523625915495048",
                "104310210228786370072723765574840903299",
                "275814167991443231315170667712118859644",
                "203673631734786624153529062367594416072",
                "210319942999459689072576913891580572980",
                "42971500172745161905769553781579969052",
                "69926012569298369209690196407489035805",
                "205802693436619835544000030877634818336",
                "60794532626564041531087166356997271471",
                "64113835251644701234544680570523160644",
                "143770093516563300388833877129314686878",
                "146397145218599905808038578468711902788"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@410896624db639500f24f46478b4bfa05c76bf56"
    },
    {
        "id": "CVE-2024-56693-bbb60c2b",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_alloc"
        },
        "digest": {
            "function_hash": "238124805543385184683515901400989636266",
            "length": 1354.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@826cc42adf44930a633d11a5993676d85ddb0842"
    },
    {
        "id": "CVE-2024-56693-bcab3406",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_cleanup"
        },
        "digest": {
            "function_hash": "153480907109585049239168789125081008507",
            "length": 291.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41219c147df8bbd6591f59af5d695fb6c9a1cbff"
    },
    {
        "id": "CVE-2024-56693-bf4c2b39",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_cleanup"
        },
        "digest": {
            "function_hash": "153480907109585049239168789125081008507",
            "length": 291.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@826cc42adf44930a633d11a5993676d85ddb0842"
    },
    {
        "id": "CVE-2024-56693-c6f8a418",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_init"
        },
        "digest": {
            "function_hash": "65140280053406527188974264111098167856",
            "length": 445.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@826cc42adf44930a633d11a5993676d85ddb0842"
    },
    {
        "id": "CVE-2024-56693-dc6c0788",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_init"
        },
        "digest": {
            "function_hash": "65140280053406527188974264111098167856",
            "length": 445.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63dfd728b30f79495dacc886127695a379805152"
    },
    {
        "id": "CVE-2024-56693-e57ce9b5",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/brd.c"
        },
        "digest": {
            "line_hashes": [
                "167224533772432193008316555342371580178",
                "339213803085541172880106363022359670147",
                "73638543936352703445541655918874719808",
                "86269134029727627044141614043848787539",
                "314214658450402851364575045042444757158",
                "270092075887499403731768901727455087391",
                "207402774889717203165776076478133946253",
                "302647119578513523092651447829443730705",
                "42361002176123089840230871615371338794",
                "322412742999700146341329593384104462678",
                "236203738220855827237921676524864357252",
                "146145900945631291609906173426009574007",
                "203054768154913937221302070546025096229",
                "3086429918230642589898985063622248084",
                "70949265446472049752484878354669277113",
                "257865092388941991244234566772367028408",
                "51219156519668754218103709679593345532",
                "187687607664120381348397860247147786498",
                "163346840329393864484824081130661544723",
                "332941848559468841127502489652549157710",
                "63991325242501749753502151284894772131",
                "245982459171805043840661858352615641612",
                "123597226273309555525131709872457912035",
                "174262405678901597965572057314051145074",
                "63195531825585511680259221346326203534",
                "225537174062866932708287016206592370210",
                "77432895895069495674507478289446219257",
                "220661227085869502072308561973867904540",
                "14155418208764675878058523625915495048",
                "104310210228786370072723765574840903299",
                "275814167991443231315170667712118859644",
                "203673631734786624153529062367594416072",
                "210319942999459689072576913891580572980",
                "42971500172745161905769553781579969052",
                "69926012569298369209690196407489035805",
                "205802693436619835544000030877634818336",
                "60794532626564041531087166356997271471",
                "64113835251644701234544680570523160644",
                "143770093516563300388833877129314686878",
                "146397145218599905808038578468711902788"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c2744cd2939ec5999c51dbaf2af16886548b7b"
    },
    {
        "id": "CVE-2024-56693-ee84f206",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Line",
        "target": {
            "file": "drivers/block/brd.c"
        },
        "digest": {
            "line_hashes": [
                "167224533772432193008316555342371580178",
                "339213803085541172880106363022359670147",
                "73638543936352703445541655918874719808",
                "86269134029727627044141614043848787539",
                "314214658450402851364575045042444757158",
                "270092075887499403731768901727455087391",
                "207402774889717203165776076478133946253",
                "302647119578513523092651447829443730705",
                "42361002176123089840230871615371338794",
                "322412742999700146341329593384104462678",
                "236203738220855827237921676524864357252",
                "146145900945631291609906173426009574007",
                "203054768154913937221302070546025096229",
                "3086429918230642589898985063622248084",
                "70949265446472049752484878354669277113",
                "257865092388941991244234566772367028408",
                "51219156519668754218103709679593345532",
                "187687607664120381348397860247147786498",
                "163346840329393864484824081130661544723",
                "332941848559468841127502489652549157710",
                "63991325242501749753502151284894772131",
                "245982459171805043840661858352615641612",
                "123597226273309555525131709872457912035",
                "174262405678901597965572057314051145074",
                "63195531825585511680259221346326203534",
                "225537174062866932708287016206592370210",
                "77432895895069495674507478289446219257",
                "220661227085869502072308561973867904540",
                "14155418208764675878058523625915495048",
                "104310210228786370072723765574840903299",
                "275814167991443231315170667712118859644",
                "203673631734786624153529062367594416072",
                "210319942999459689072576913891580572980",
                "42971500172745161905769553781579969052",
                "69926012569298369209690196407489035805",
                "205802693436619835544000030877634818336",
                "60794532626564041531087166356997271471",
                "64113835251644701234544680570523160644",
                "143770093516563300388833877129314686878",
                "146397145218599905808038578468711902788"
            ],
            "threshold": 0.9
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@826cc42adf44930a633d11a5993676d85ddb0842"
    },
    {
        "id": "CVE-2024-56693-fc2cf461",
        "deprecated": false,
        "signature_version": "v1",
        "signature_type": "Function",
        "target": {
            "file": "drivers/block/brd.c",
            "function": "brd_cleanup"
        },
        "digest": {
            "function_hash": "153480907109585049239168789125081008507",
            "length": 291.0
        },
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63dfd728b30f79495dacc886127695a379805152"
    }
]