AZL-55434
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-55434.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-55434
- Upstream
- Published
- 2024-12-27T14:15:30Z
- Modified
- 2026-04-01T05:18:37.154214Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- CVE-2024-53227 affecting package kernel for versions less than 6.6.64.2-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
scsi: bfa: Fix use-after-free in bfadimmodule_exit()
BUG: KASAN: slab-use-after-free in _lockacquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303
Call Trace: <TASK> dumpstacklvl+0x95/0xe0 printreport+0xcb/0x620 kasanreport+0xbd/0xf0 __lockacquire+0x2aca/0x3a20 lockacquire+0x19b/0x520 rawspin_lock+0x2b/0x40 attributecontainerunregister+0x30/0x160 fcreleasetransport+0x19/0x90 [scsitransportfc] bfadimmoduleexit+0x23/0x60 [bfa] bfadinit+0xdb/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f </TASK>
Allocated by task 25303: kasansavestack+0x24/0x50 kasansavetrack+0x14/0x30 __kasankmalloc+0x7f/0x90 fcattach_transport+0x4f/0x4740 [scsitransportfc] bfadimmoduleinit+0x17/0x80 [bfa] bfadinit+0x23/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Freed by task 25303: kasansavestack+0x24/0x50 kasansavetrack+0x14/0x30 kasansavefree_info+0x3b/0x60 __kasanslabfree+0x38/0x50 kfree+0x212/0x480 bfadimmoduleinit+0x7e/0x80 [bfa] bfadinit+0x23/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f
Above issue happens as follows:
bfadinit error = bfadimmoduleinit() fcreleasetransport(bfadimscsitransporttemplate); if (error) goto ext;
ext: bfadimmoduleexit(); fcreleasetransport(bfadimscsitransport_template); --> Trigger double release
Don't call bfadimmoduleexit() if bfadimmoduleinit() failed.
- References