CVE-2024-47706 (GCVE-0-2024-47706)
Vulnerability from cvelistv5
Published
2024-10-21 11:53
Modified
2026-08-05 11:39
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible UAF for bfqq->bic with merge chain 1) initial state, three tasks: Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) | Λ | Λ | Λ | | | | | | V | V | V | bfqq1 bfqq2 bfqq3 process ref: 1 1 1 2) bfqq1 merged to bfqq2: Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) | | | Λ \--------------\| | | V V | bfqq1--------->bfqq2 bfqq3 process ref: 0 2 1 3) bfqq2 merged to bfqq3: Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) here -> Λ | | \--------------\ \-------------\| V V bfqq1--------->bfqq2---------->bfqq3 process ref: 0 1 3 In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then get bfqq3 through merge chain, and finially handle IO by bfqq3. Howerver, current code will think bfqq2 is owned by BIC1, like initial state, and set bfqq2->bic to BIC1. bfq_insert_request -> by Process 1 bfqq = bfq_init_rq(rq) bfqq = bfq_get_bfqq_handle_split bfqq = bic_to_bfqq -> get bfqq2 from BIC1 bfqq->ref++ rq->elv.priv[0] = bic rq->elv.priv[1] = bfqq if (bfqq_process_refs(bfqq) == 1) bfqq->bic = bic -> record BIC1 to bfqq2 __bfq_insert_request new_bfqq = bfq_setup_cooperator -> get bfqq3 from bfqq2->new_bfqq bfqq_request_freed(bfqq) new_bfqq->ref++ rq->elv.priv[1] = new_bfqq -> handle IO by bfqq3 Fix the problem by checking bfqq is from merge chain fist. And this might fix a following problem reported by our syzkaller(unreproducible): ================================================================== BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595 CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G L 6.6.0-07439-gba2303cacfda #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Workqueue: kblockd blk_mq_requeue_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x10d/0x610 mm/kasan/report.c:475 kasan_report+0x8e/0xc0 mm/kasan/report.c:588 bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757 bfq_init_rq block/bfq-iosched.c:6876 [inline] bfq_insert_request block/bfq-iosched.c:6254 [inline] bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304 blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593 blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 </TASK> Allocated by task 20776: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3458 [inline] kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503 ioc_create_icq block/blk-ioc.c:370 [inline] ---truncated---
References
Impacted products
Vendor Product Version
Linux Linux Version: 36eca894832351feed9072d0f97eb06fc9482ca4
Version: 36eca894832351feed9072d0f97eb06fc9482ca4
Version: 36eca894832351feed9072d0f97eb06fc9482ca4
Version: 36eca894832351feed9072d0f97eb06fc9482ca4
Version: 36eca894832351feed9072d0f97eb06fc9482ca4
Version: 36eca894832351feed9072d0f97eb06fc9482ca4
Version: 36eca894832351feed9072d0f97eb06fc9482ca4
Version: 36eca894832351feed9072d0f97eb06fc9482ca4
Version: 36eca894832351feed9072d0f97eb06fc9482ca4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47706",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T13:03:53.838190Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:19.673Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:21:10.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM-/XRM-/XCH-/XRH-300 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.2",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T11:58:28.698Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-355557.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/bfq-iosched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a9bdd5b36887d2bacb8bc777fd18317c99fc2587",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            },
            {
              "lessThan": "bc2140534b2aae752e4f7cb4489642dbb5ec4777",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            },
            {
              "lessThan": "e1277ae780cca4e69ef5468d4582dfd48f0b8320",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            },
            {
              "lessThan": "8aa9de02a4be2e7006e636816ce19b0d667ceaa3",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            },
            {
              "lessThan": "ddbdaad123254fb53e32480cb74a486a6868b1e0",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            },
            {
              "lessThan": "7faed2896d78e48ec96229e73b30b0af6c00a9aa",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            },
            {
              "lessThan": "880692ee233ba63808182705b3333403413b58f5",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            },
            {
              "lessThan": "6d130db286ad0ea392c96ebb2551acf0d7308048",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            },
            {
              "lessThan": "18ad4df091dd5d067d2faa8fce1180b79f7041a7",
              "status": "affected",
              "version": "36eca894832351feed9072d0f97eb06fc9482ca4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/bfq-iosched.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.54",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix possible UAF for bfqq-\u003ebic with merge chain\n\n1) initial state, three tasks:\n\n\t\tProcess 1       Process 2\tProcess 3\n\t\t (BIC1)          (BIC2)\t\t (BIC3)\n\t\t  |  \u039b            |  \u039b\t\t  |  \u039b\n\t\t  |  |            |  |\t\t  |  |\n\t\t  V  |            V  |\t\t  V  |\n\t\t  bfqq1           bfqq2\t\t  bfqq3\nprocess ref:\t   1\t\t    1\t\t    1\n\n2) bfqq1 merged to bfqq2:\n\n\t\tProcess 1       Process 2\tProcess 3\n\t\t (BIC1)          (BIC2)\t\t (BIC3)\n\t\t  |               |\t\t  |  \u039b\n\t\t  \\--------------\\|\t\t  |  |\n\t\t                  V\t\t  V  |\n\t\t  bfqq1---------\u003ebfqq2\t\t  bfqq3\nprocess ref:\t   0\t\t    2\t\t    1\n\n3) bfqq2 merged to bfqq3:\n\n\t\tProcess 1       Process 2\tProcess 3\n\t\t (BIC1)          (BIC2)\t\t (BIC3)\n\t here -\u003e \u039b                |\t\t  |\n\t\t  \\--------------\\ \\-------------\\|\n\t\t                  V\t\t  V\n\t\t  bfqq1---------\u003ebfqq2----------\u003ebfqq3\nprocess ref:\t   0\t\t    1\t\t    3\n\nIn this case, IO from Process 1 will get bfqq2 from BIC1 first, and then\nget bfqq3 through merge chain, and finially handle IO by bfqq3.\nHowerver, current code will think bfqq2 is owned by BIC1, like initial\nstate, and set bfqq2-\u003ebic to BIC1.\n\nbfq_insert_request\n-\u003e by Process 1\n bfqq = bfq_init_rq(rq)\n  bfqq = bfq_get_bfqq_handle_split\n   bfqq = bic_to_bfqq\n   -\u003e get bfqq2 from BIC1\n bfqq-\u003eref++\n rq-\u003eelv.priv[0] = bic\n rq-\u003eelv.priv[1] = bfqq\n if (bfqq_process_refs(bfqq) == 1)\n  bfqq-\u003ebic = bic\n  -\u003e record BIC1 to bfqq2\n\n  __bfq_insert_request\n   new_bfqq = bfq_setup_cooperator\n   -\u003e get bfqq3 from bfqq2-\u003enew_bfqq\n   bfqq_request_freed(bfqq)\n   new_bfqq-\u003eref++\n   rq-\u003eelv.priv[1] = new_bfqq\n   -\u003e handle IO by bfqq3\n\nFix the problem by checking bfqq is from merge chain fist. And this\nmight fix a following problem reported by our syzkaller(unreproducible):\n\n==================================================================\nBUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\nBUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\nBUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\nWrite of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595\n\nCPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G             L     6.6.0-07439-gba2303cacfda #6\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\nWorkqueue: kblockd blk_mq_requeue_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106\n print_address_description mm/kasan/report.c:364 [inline]\n print_report+0x10d/0x610 mm/kasan/report.c:475\n kasan_report+0x8e/0xc0 mm/kasan/report.c:588\n bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\n bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\n bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\n bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757\n bfq_init_rq block/bfq-iosched.c:6876 [inline]\n bfq_insert_request block/bfq-iosched.c:6254 [inline]\n bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304\n blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593\n blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502\n process_one_work kernel/workqueue.c:2627 [inline]\n process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700\n worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781\n kthread+0x33c/0x440 kernel/kthread.c:388\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305\n \u003c/TASK\u003e\n\nAllocated by task 20776:\n kasan_save_stack+0x20/0x40 mm/kasan/common.c:45\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328\n kasan_slab_alloc include/linux/kasan.h:188 [inline]\n slab_post_alloc_hook mm/slab.h:763 [inline]\n slab_alloc_node mm/slub.c:3458 [inline]\n kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503\n ioc_create_icq block/blk-ioc.c:370 [inline]\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the BFQ I/O scheduler and is reached through ordinary block I/O submission (read/write/fsync on a device using the bfq elevator), which requires local access to the system. There is no network-facing path to bfq queue merging.\nAC:L - The attacker controls every precondition \u2014 it forks the cooperating processes that build the bfqq merge chain, drives the sync I/O pattern that triggers early/stable merging, and chooses when to exit a process to free its bfq_io_cq \u2014 so the dangling bfqq-\u003ebic can be created and dereferenced deterministically, and the freed slab object is refilled from the same cache by simply spawning more I/O tasks.\nPR:L - Only an unprivileged local user account is needed; no capability, namespace trick, or admin right is checked on the bfq_prepare_request/bfq_insert_request path \u2014 issuing I/O to any file on a bfq-managed device suffices.\nUI:N - The attacker\u0027s own processes generate all the I/O and the process exit that frees the bfq_io_cq; no action by any other user is required.\nS:U - The corruption is confined to kernel heap objects managed by the block layer within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The stale bfqq-\u003ebic is read back through bfq_bfqq_resume_state()/bic_to_bfqq(), pulling bfq_queue pointers and saved state out of a freed 1360-byte object the attacker can reclaim and control, giving an information-disclosure/arbitrary-read primitive on kernel memory.\nI:H - bfq_do_early_stable_merge() and bfq_bfqq_save_state() perform writes into the freed bfq_io_cq (the KASAN slab-use-after-free write in the report), and the pointers read back out are dereferenced as live bfq_queues, which is exploitable for heap corruption and control-flow hijack.\nA:H - The use-after-free reliably corrupts kernel heap state and causes oops/panic (the reported KASAN slab-use-after-free in bfq_get_queue from a kblockd worker), crashing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:39:37.119Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a9bdd5b36887d2bacb8bc777fd18317c99fc2587"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc2140534b2aae752e4f7cb4489642dbb5ec4777"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1277ae780cca4e69ef5468d4582dfd48f0b8320"
        },
        {
          "url": "https://git.kernel.org/stable/c/8aa9de02a4be2e7006e636816ce19b0d667ceaa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddbdaad123254fb53e32480cb74a486a6868b1e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7faed2896d78e48ec96229e73b30b0af6c00a9aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/880692ee233ba63808182705b3333403413b58f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d130db286ad0ea392c96ebb2551acf0d7308048"
        },
        {
          "url": "https://git.kernel.org/stable/c/18ad4df091dd5d067d2faa8fce1180b79f7041a7"
        }
      ],
      "title": "block, bfq: fix possible UAF for bfqq-\u003ebic with merge chain",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47706",
    "datePublished": "2024-10-21T11:53:40.759Z",
    "dateReserved": "2024-09-30T16:00:12.946Z",
    "dateUpdated": "2026-08-05T11:39:37.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:21:10.318Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"RUGGEDCOM RST2428P\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SCALANCE XCM-/XRM-/XCH-/XRH-300 family\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V3.2\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-265688.html\"}, {\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-355557.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-05-12T11:58:28.698Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47706\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-21T13:03:53.838190Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-21T13:03:56.861Z\"}}], \"cna\": {\"title\": \"block, bfq: fix possible UAF for bfqq-\u003ebic with merge chain\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the BFQ I/O scheduler and is reached through ordinary block I/O submission (read/write/fsync on a device using the bfq elevator), which requires local access to the system. There is no network-facing path to bfq queue merging.\\nAC:L - The attacker controls every precondition \\u2014 it forks the cooperating processes that build the bfqq merge chain, drives the sync I/O pattern that triggers early/stable merging, and chooses when to exit a process to free its bfq_io_cq \\u2014 so the dangling bfqq-\u003ebic can be created and dereferenced deterministically, and the freed slab object is refilled from the same cache by simply spawning more I/O tasks.\\nPR:L - Only an unprivileged local user account is needed; no capability, namespace trick, or admin right is checked on the bfq_prepare_request/bfq_insert_request path \\u2014 issuing I/O to any file on a bfq-managed device suffices.\\nUI:N - The attacker\u0027s own processes generate all the I/O and the process exit that frees the bfq_io_cq; no action by any other user is required.\\nS:U - The corruption is confined to kernel heap objects managed by the block layer within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\\nC:H - The stale bfqq-\u003ebic is read back through bfq_bfqq_resume_state()/bic_to_bfqq(), pulling bfq_queue pointers and saved state out of a freed 1360-byte object the attacker can reclaim and control, giving an information-disclosure/arbitrary-read primitive on kernel memory.\\nI:H - bfq_do_early_stable_merge() and bfq_bfqq_save_state() perform writes into the freed bfq_io_cq (the KASAN slab-use-after-free write in the report), and the pointers read back out are dereferenced as live bfq_queues, which is exploitable for heap corruption and control-flow hijack.\\nA:H - The use-after-free reliably corrupts kernel heap state and causes oops/panic (the reported KASAN slab-use-after-free in bfq_get_queue from a kblockd worker), crashing the system.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"a9bdd5b36887d2bacb8bc777fd18317c99fc2587\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"bc2140534b2aae752e4f7cb4489642dbb5ec4777\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"e1277ae780cca4e69ef5468d4582dfd48f0b8320\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"8aa9de02a4be2e7006e636816ce19b0d667ceaa3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"ddbdaad123254fb53e32480cb74a486a6868b1e0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"7faed2896d78e48ec96229e73b30b0af6c00a9aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"880692ee233ba63808182705b3333403413b58f5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"6d130db286ad0ea392c96ebb2551acf0d7308048\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"36eca894832351feed9072d0f97eb06fc9482ca4\", \"lessThan\": \"18ad4df091dd5d067d2faa8fce1180b79f7041a7\", \"versionType\": \"git\"}], \"programFiles\": [\"block/bfq-iosched.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.54\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.13\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"block/bfq-iosched.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a9bdd5b36887d2bacb8bc777fd18317c99fc2587\"}, {\"url\": \"https://git.kernel.org/stable/c/bc2140534b2aae752e4f7cb4489642dbb5ec4777\"}, {\"url\": \"https://git.kernel.org/stable/c/e1277ae780cca4e69ef5468d4582dfd48f0b8320\"}, {\"url\": \"https://git.kernel.org/stable/c/8aa9de02a4be2e7006e636816ce19b0d667ceaa3\"}, {\"url\": \"https://git.kernel.org/stable/c/ddbdaad123254fb53e32480cb74a486a6868b1e0\"}, {\"url\": \"https://git.kernel.org/stable/c/7faed2896d78e48ec96229e73b30b0af6c00a9aa\"}, {\"url\": \"https://git.kernel.org/stable/c/880692ee233ba63808182705b3333403413b58f5\"}, {\"url\": \"https://git.kernel.org/stable/c/6d130db286ad0ea392c96ebb2551acf0d7308048\"}, {\"url\": \"https://git.kernel.org/stable/c/18ad4df091dd5d067d2faa8fce1180b79f7041a7\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nblock, bfq: fix possible UAF for bfqq-\u003ebic with merge chain\\n\\n1) initial state, three tasks:\\n\\n\\t\\tProcess 1       Process 2\\tProcess 3\\n\\t\\t (BIC1)          (BIC2)\\t\\t (BIC3)\\n\\t\\t  |  \\u039b            |  \\u039b\\t\\t  |  \\u039b\\n\\t\\t  |  |            |  |\\t\\t  |  |\\n\\t\\t  V  |            V  |\\t\\t  V  |\\n\\t\\t  bfqq1           bfqq2\\t\\t  bfqq3\\nprocess ref:\\t   1\\t\\t    1\\t\\t    1\\n\\n2) bfqq1 merged to bfqq2:\\n\\n\\t\\tProcess 1       Process 2\\tProcess 3\\n\\t\\t (BIC1)          (BIC2)\\t\\t (BIC3)\\n\\t\\t  |               |\\t\\t  |  \\u039b\\n\\t\\t  \\\\--------------\\\\|\\t\\t  |  |\\n\\t\\t                  V\\t\\t  V  |\\n\\t\\t  bfqq1---------\u003ebfqq2\\t\\t  bfqq3\\nprocess ref:\\t   0\\t\\t    2\\t\\t    1\\n\\n3) bfqq2 merged to bfqq3:\\n\\n\\t\\tProcess 1       Process 2\\tProcess 3\\n\\t\\t (BIC1)          (BIC2)\\t\\t (BIC3)\\n\\t here -\u003e \\u039b                |\\t\\t  |\\n\\t\\t  \\\\--------------\\\\ \\\\-------------\\\\|\\n\\t\\t                  V\\t\\t  V\\n\\t\\t  bfqq1---------\u003ebfqq2----------\u003ebfqq3\\nprocess ref:\\t   0\\t\\t    1\\t\\t    3\\n\\nIn this case, IO from Process 1 will get bfqq2 from BIC1 first, and then\\nget bfqq3 through merge chain, and finially handle IO by bfqq3.\\nHowerver, current code will think bfqq2 is owned by BIC1, like initial\\nstate, and set bfqq2-\u003ebic to BIC1.\\n\\nbfq_insert_request\\n-\u003e by Process 1\\n bfqq = bfq_init_rq(rq)\\n  bfqq = bfq_get_bfqq_handle_split\\n   bfqq = bic_to_bfqq\\n   -\u003e get bfqq2 from BIC1\\n bfqq-\u003eref++\\n rq-\u003eelv.priv[0] = bic\\n rq-\u003eelv.priv[1] = bfqq\\n if (bfqq_process_refs(bfqq) == 1)\\n  bfqq-\u003ebic = bic\\n  -\u003e record BIC1 to bfqq2\\n\\n  __bfq_insert_request\\n   new_bfqq = bfq_setup_cooperator\\n   -\u003e get bfqq3 from bfqq2-\u003enew_bfqq\\n   bfqq_request_freed(bfqq)\\n   new_bfqq-\u003eref++\\n   rq-\u003eelv.priv[1] = new_bfqq\\n   -\u003e handle IO by bfqq3\\n\\nFix the problem by checking bfqq is from merge chain fist. And this\\nmight fix a following problem reported by our syzkaller(unreproducible):\\n\\n==================================================================\\nBUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\\nBUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\\nBUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\\nWrite of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595\\n\\nCPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G             L     6.6.0-07439-gba2303cacfda #6\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\\nWorkqueue: kblockd blk_mq_requeue_work\\nCall Trace:\\n \u003cTASK\u003e\\n __dump_stack lib/dump_stack.c:88 [inline]\\n dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106\\n print_address_description mm/kasan/report.c:364 [inline]\\n print_report+0x10d/0x610 mm/kasan/report.c:475\\n kasan_report+0x8e/0xc0 mm/kasan/report.c:588\\n bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\\n bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\\n bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\\n bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757\\n bfq_init_rq block/bfq-iosched.c:6876 [inline]\\n bfq_insert_request block/bfq-iosched.c:6254 [inline]\\n bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304\\n blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593\\n blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502\\n process_one_work kernel/workqueue.c:2627 [inline]\\n process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700\\n worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781\\n kthread+0x33c/0x440 kernel/kthread.c:388\\n ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\\n ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305\\n \u003c/TASK\u003e\\n\\nAllocated by task 20776:\\n kasan_save_stack+0x20/0x40 mm/kasan/common.c:45\\n kasan_set_track+0x25/0x30 mm/kasan/common.c:52\\n __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328\\n kasan_slab_alloc include/linux/kasan.h:188 [inline]\\n slab_post_alloc_hook mm/slab.h:763 [inline]\\n slab_alloc_node mm/slub.c:3458 [inline]\\n kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503\\n ioc_create_icq block/blk-ioc.c:370 [inline]\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.54\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.13\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.2\", \"versionStartIncluding\": \"4.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"4.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:39:37.119Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47706\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:39:37.119Z\", \"dateReserved\": \"2024-09-30T16:00:12.946Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T11:53:40.759Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.