{"id":"CVE-2024-56672","revision":"775b6b900da14daab128c8ff2ab3b100","records":[{"revision":"775b6b900da14daab128c8ff2ab3b100","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-56672","aliases":[],"title":"blk-cgroup: Fix UAF in blkcg_unpin_online()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Fix UAF in blkcg_unpin_online()\n\nblkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To\nwalk up, it uses blkcg_parent(blkcg) but it was calling that after\nblkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the\nfollowing UAF:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270\n Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117\n\n CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\n Workqueue: cgwb_release cgwb_release_workfn\n Call Trace:\n \n dump_stack_lvl+0x27/0x80\n print_report+0x151/0x710\n kasan_report+0xc0/0x100\n blkcg_unpin_online+0x15a/0x270\n cgwb_release_workfn+0x194/0x480\n process_scheduled_works+0x71b/0xe20\n worker_thread+0x82a/0xbd0\n kthread+0x242/0x2c0\n ret_from_fork+0x33/0x70\n ret_from_fork_asm+0x1a/0x30\n \n ...\n Freed by task 1944:\n kasan_save_track+0x2b/0x70\n kasan_save_free_info+0x3c/0x50\n __kasan_slab_free+0x33/0x50\n kfree+0x10c/0x330\n css_free_rwork_fn+0xe6/0xb30\n process_scheduled_works+0x71b/0xe20\n worker_thread+0x82a/0xbd0\n kthread+0x242/0x2c0\n ret_from_fork+0x33/0x70\n ret_from_fork_asm+0x1a/0x30\n\nNote that the UAF is not easy to trigger as the free path is indirected\nbehind a couple RCU grace periods and a work item execution. I could only\ntrigger it with artifical msleep() injected in blkcg_unpin_online().\n\nFix it by reading the parent pointer before destroying the blkcg's blkg's.","state":0,"publishedAt":"2024-12-27T15:06:33.358+00:00","modifiedAt":"2026-10-15T01:00:09.676+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"block/blk-cgroup.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\",\n \"lessThan\": \"83f5a87ee8caa76a917f59912a74d6811f773c67\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\",\n \"lessThan\": \"8a07350fe070017a887433f4d6909433955be5f1\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\",\n \"lessThan\": \"64afc6fe24c9896c0153e5a199bcea241ecb0d5c\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\",\n \"lessThan\": \"5baa28569c924d9a90d036c2aaab79f791fedaf8\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\",\n \"lessThan\": \"29d1e06560f0f6179062ac638b4064deb637d1ad\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"4308a434e5e08c78676aa66bc626ef78cbef0883\",\n \"lessThan\": \"86e6ca55b83c575ab0f2e105cf08f98e58d3d7af\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"block/blk-cgroup.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.7\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.7\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.234\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.177\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.121\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.67\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.6\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.13\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/83f5a87ee8caa76a917f59912a74d6811f773c67","https://git.kernel.org/stable/c/8a07350fe070017a887433f4d6909433955be5f1","https://git.kernel.org/stable/c/64afc6fe24c9896c0153e5a199bcea241ecb0d5c","https://git.kernel.org/stable/c/5baa28569c924d9a90d036c2aaab79f791fedaf8","https://git.kernel.org/stable/c/29d1e06560f0f6179062ac638b4064deb637d1ad","https://git.kernel.org/stable/c/86e6ca55b83c575ab0f2e105cf08f98e58d3d7af"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-56672","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-56672","identifiers":["CVE-2024-56672"]},"retained":false,"historicalAffected":[]}],"coverage":[]}