{
  "threat_severity" : "Moderate",
  "public_date" : "2024-12-27T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: blk-cgroup: Fix UAF in blkcg_unpin_online()",
    "id" : "2334537",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2334537"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.4",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-416",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nblk-cgroup: Fix UAF in blkcg_unpin_online()\nblkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To\nwalk up, it uses blkcg_parent(blkcg) but it was calling that after\nblkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the\nfollowing UAF:\n==================================================================\nBUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270\nRead of size 8 at addr ffff8881057678c0 by task kworker/9:1/117\nCPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\nWorkqueue: cgwb_release cgwb_release_workfn\nCall Trace:\n<TASK>\ndump_stack_lvl+0x27/0x80\nprint_report+0x151/0x710\nkasan_report+0xc0/0x100\nblkcg_unpin_online+0x15a/0x270\ncgwb_release_workfn+0x194/0x480\nprocess_scheduled_works+0x71b/0xe20\nworker_thread+0x82a/0xbd0\nkthread+0x242/0x2c0\nret_from_fork+0x33/0x70\nret_from_fork_asm+0x1a/0x30\n</TASK>\n...\nFreed by task 1944:\nkasan_save_track+0x2b/0x70\nkasan_save_free_info+0x3c/0x50\n__kasan_slab_free+0x33/0x50\nkfree+0x10c/0x330\ncss_free_rwork_fn+0xe6/0xb30\nprocess_scheduled_works+0x71b/0xe20\nworker_thread+0x82a/0xbd0\nkthread+0x242/0x2c0\nret_from_fork+0x33/0x70\nret_from_fork_asm+0x1a/0x30\nNote that the UAF is not easy to trigger as the free path is indirected\nbehind a couple RCU grace periods and a work item execution. I could only\ntrigger it with artifical msleep() injected in blkcg_unpin_online().\nFix it by reading the parent pointer before destroying the blkcg's blkg's." ],
  "statement" : "This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20518",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-611.5.1.el9_7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2025-11-11T00:00:00Z",
    "advisory" : "RHSA-2025:20518",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-611.5.1.el9_7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-56672\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56672\nhttps://lore.kernel.org/linux-cve-announce/2024122755-CVE-2024-56672-8d29@gregkh/T" ],
  "name" : "CVE-2024-56672",
  "csaw" : false
}