AZL-59043
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-59043.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-59043
- Upstream
- Published
- 2025-02-27T02:15:16Z
- Modified
- 2026-04-01T05:19:23.991064Z
- Summary
- CVE-2025-21731 affecting package kernel for versions less than 5.15.180.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
nbd: don't allow reconnect after disconnect
Following process can cause nbd_config UAF:
1) grab nbd_config temporarily;
2) nbdgenldisconnect() flush all recv_work() and release the initial reference:
nbdgenldisconnect nbddisconnectandput nbddisconnect flushworkqueue(nbd->recvworkq) if (testandclearbit(NBDRTHASCONFIGREF, ...)) nbdconfig_put -> due to step 1), reference is still not zero
3) nbdgenlreconfigure() queue recv_work() again;
nbdgenlreconfigure config = nbdgetconfigunlocked(nbd) if (!config) -> succeed if (!testbit(NBDRTBOUND, ...)) -> succeed nbdreconnectsocket queuework(nbd->recvworkq, &args->work)
4) step 1) release the reference;
5) Finially, recv_work() will trigger UAF:
recvwork nbdconfigput(nbd) -> nbdconfig is freed atomicdec(&config->recvthreads) -> UAF
Fix the problem by clearing NBDRTBOUND in nbdgenldisconnect(), so that nbdgenlreconfigure() will fail.
- References