Описание
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Don't call folio_wait_writeback() without a folio reference folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference.
Отчет
A use-after-free race condition was found in the Linux kernel s390/uv (ultravisor) subsystem. folio_wait_writeback() was called without holding a folio reference after the page table lock (PTL) was dropped, so the folio being waited on could be freed concurrently. A local privileged user able to reach this code path on an affected s390 system could exploit the race, most likely causing a kernel fault and denial of service. Red Hat assesses this flaw as LOW severity (CVSS 3.3, availability impact only) because it is specific to the s390 architecture, requires local privileged access, and has no demonstrated confidentiality or integrity impact; this differs significantly from the upstream CVEORG rating of IMPORTANT (7.8), which assumes high confidentiality, integrity, and availability impacts not supported by the technical evidence. According to current Red Hat tracking, Red Hat Enterprise Linux 6, 8, and 9 and the Hosted OpenShift (ARO/OSD) streams are not affected, and the RHEL 7 ELS entries are out of support scope; only Fedora is affected, with a fix being pursued through the community kernel maintainers (delegated resolution).
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. For the affected Fedora kernel, updating to the latest kernel package provided by Fedora includes the fix; the upstream advisory likewise recommends updating to the latest stable Linux kernel version.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
3.3 Low
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Don't call folio_wait_writeback() without a folio reference folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference.
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Don't call folio_wait_writeback() without a folio reference folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference.
s390/uv: Don't call folio_wait_writeback() without a folio reference
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: s390/uv: Don't call folio_wait_writeback() without a folio reference folio_wait_writeback() requires that no spinlocks are held and that a folio reference is held, as documented. After we dropped the PTL, the folio could get freed concurrently. So grab a temporary reference.
EPSS
3.3 Low
CVSS3