CVE-2024-40909

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix a potential use-after-free in bpf_link_free()

After commit 1a80dbcb2dba, bpf_link can be freed by link->ops->dealloc_deferred, but the code still tests and uses link->ops->dealloc afterward, which leads to a use-after-free as reported by syzbot. Actually, one of them should be sufficient, so just call one of them instead of both. Also add a WARN_ON() in case of any problematic implementation.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/2884dc7d08d98a89d8d65121524bb7533183a63a
• https://git.kernel.org/stable/c/91cff53136daeff50816b0baeafd38a6976f6209
• https://git.kernel.org/stable/c/fa97b8fed9896f1e89cb657513e483a152d4c382
• https://git.kernel.org/stable/c/2884dc7d08d98a89d8d65121524bb7533183a63a
• https://git.kernel.org/stable/c/91cff53136daeff50816b0baeafd38a6976f6209
• https://git.kernel.org/stable/c/fa97b8fed9896f1e89cb657513e483a152d4c382