ipe: fix use-after-free when auditing a newly loaded policy
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.112, 6.18.55, 7.2.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy new_policy() audits the policy after ipe_new_policyfs_node() publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while ipe_audit_policy_load() is still using it. Audit the successful load under that lock. [FW: remove model name according to latest guideline]
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From f44554b5067b36c14cc91ed811fa1bd58baed34a · fixed in b72d6c72b4bfbc021e8e127fa13e0f27d09be737; From f44554b5067b36c14cc91ed811fa1bd58baed34a · fixed in 48f7d0233c3cc8d986d1177d0e5dd4af435e7265; From f44554b5067b36c14cc91ed811fa1bd58baed34a · fixed in e9015d32752fa228ef2f0e07fd93fc53a4a4c723; From f44554b5067b36c14cc91ed811fa1bd58baed34a · fixed in 9814077275eca36ebf8d510d2f076d235ff9f51a
- Linux Linux
6.12
- KernelLinux
From 6.12.0 · fixed in 6.12.112; From 6.13.0 · fixed in 6.18.55; From 6.19.0 · fixed in 7.2.9