fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.18.50, 7.1, 7.2.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free The abort_on_kill path in request_wait_answer() calls fuse_abort_conn() and returns without waiting for FR_FINISHED. If fuse_dev_do_write() is concurrently processing the same request (FR_LOCKED set), the caller frees req->args while it is still being accessed, causing a use-after-free. Fix this by jumping to the existing wait_event(FR_FINISHED) instead of returning early. The wait will not hang because fuse_abort_conn() ensures all requests are ended.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 0c7fca880a40a209a9c92be14143996d14b93ff6 · fixed in a8bbb2a60513bf322170903c21462f0bf4f62be2; From 204aa22a686bfee48daca7db620c1e017615f2ff · fixed in 715cb86e33cda43f5224cdc3fd5610c0b6a46f7a; From 204aa22a686bfee48daca7db620c1e017615f2ff · fixed in 64b0b5cacbd2fea88001464cb712c9dfc795b26e; From 6.18.25 · fixed in 6.18.50; From 7.0.2 · fixed in 7.1
- Linux Linux
7.1
- KernelLinux
fixed in 6.18.50; From 6.19.0 · fixed in 7.2.3