ipe: protect the dm-verity root hash with RCU
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.112, 6.18.55, 7.2.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipe_bdev_setintegrity() frees the old root hash when dm-verity publishes a new one on ->preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. The evaluation path already runs under rcu_read_lock(). [FW: remove model name according to latest guideline]
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From e155858dd99523d4afe0f74e9c26e4f4499eb5af · fixed in 3bd335ed62444bec61201df7d368a0779e5bd300; From e155858dd99523d4afe0f74e9c26e4f4499eb5af · fixed in 599d0498a39319285afa908762e0c9fad29f772e; From e155858dd99523d4afe0f74e9c26e4f4499eb5af · fixed in d7c5bd3159235edb0f2febe2cd3d3b0fb53986f1; From e155858dd99523d4afe0f74e9c26e4f4499eb5af · fixed in 2776e9c28513a1c855a94792b292cbcc533418c8
- Linux Linux
6.12
- KernelLinux
From 6.12.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.55; From 6.19.0 · fixed in 7.2.9