CVE-2024-53227

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-53227
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53227.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-53227
Downstream
Related
Published
2024-12-27T13:50:16.175Z
Modified
2026-03-20T12:40:50.168119Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: bfa: Fix use-after-free in bfadimmodule_exit()

BUG: KASAN: slab-use-after-free in _lockacquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303

Call Trace: <TASK> dumpstacklvl+0x95/0xe0 printreport+0xcb/0x620 kasanreport+0xbd/0xf0 __lockacquire+0x2aca/0x3a20 lockacquire+0x19b/0x520 rawspin_lock+0x2b/0x40 attributecontainerunregister+0x30/0x160 fcreleasetransport+0x19/0x90 [scsitransportfc] bfadimmoduleexit+0x23/0x60 [bfa] bfadinit+0xdb/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f </TASK>

Allocated by task 25303: kasansavestack+0x24/0x50 kasansavetrack+0x14/0x30 __kasankmalloc+0x7f/0x90 fcattach_transport+0x4f/0x4740 [scsitransportfc] bfadimmoduleinit+0x17/0x80 [bfa] bfadinit+0x23/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f

Freed by task 25303: kasansavestack+0x24/0x50 kasansavetrack+0x14/0x30 kasansavefree_info+0x3b/0x60 __kasanslabfree+0x38/0x50 kfree+0x212/0x480 bfadimmoduleinit+0x7e/0x80 [bfa] bfadinit+0x23/0xff0 [bfa] dooneinitcall+0xdc/0x550 doinitmodule+0x22d/0x6b0 loadmodule+0x4e96/0x5ff0 initmodulefromfile+0xcd/0x130 idempotentinitmodule+0x330/0x620 _x64sysfinitmodule+0xb3/0x110 dosyscall64+0xc1/0x1d0 entrySYSCALL64afterhwframe+0x77/0x7f

Above issue happens as follows:

bfadinit error = bfadimmoduleinit() fcreleasetransport(bfadimscsitransporttemplate); if (error) goto ext;

ext: bfadimmoduleexit(); fcreleasetransport(bfadimscsitransport_template); --> Trigger double release

Don't call bfadimmoduleexit() if bfadimmoduleinit() failed.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53227.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
7725ccfda59715ecf8f99e3b520a0b84cc2ea79e
Fixed
0ceac8012d3ddea3317f0d82934293d05feb8af1
Fixed
3932c753f805a02e9364a4c58b590f21901f8490
Fixed
ef2c2580189ea88a0dcaf56eb3a565763a900edb
Fixed
e76181a5be90abcc3ed8a300bd13878aa214d022
Fixed
8f5a97443b547b4c83f876f1d6a11df0f1fd4efb
Fixed
c28409f851abd93b37969cac7498828ad533afd9
Fixed
1ffdde30a90bf8efe8f270407f486706962b3292
Fixed
a2b5035ab0e368e8d8a371e27fbc72f133c0bd40
Fixed
178b8f38932d635e90f5f0e9af1986c6f4a89271

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-53227.json"