CVE-2024-56672·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix UAF in blkcg_unpin_online() blkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To walk up, it uses blkcg_parent(blkcg) but it was calling that after blkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the following UAF: ================================================================== BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270 Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117 CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> dump_stack_lvl+0x27/0x80 print_report+0x151/0x710 kasan_report+0xc0/0x100 blkcg_unpin_online+0x15a/0x270 cgwb_release_workfn+0x194/0x480 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 </TASK> ... Freed by task 1944: kasan_save_track+0x2b/0x70 kasan_save_free_info+0x3c/0x50 __kasan_slab_free+0x33/0x50 kfree+0x10c/0x330 css_free_rwork_fn+0xe6/0xb30 process_scheduled_works+0x71b/0xe20 worker_thread+0x82a/0xbd0 kthread+0x242/0x2c0 ret_from_fork+0x33/0x70 ret_from_fork_asm+0x1a/0x30 Note that the UAF is not easy to trigger as the free path is indirected behind a couple RCU grace periods and a work item execution. I could only trigger it with artifical msleep() injected in blkcg_unpin_online(). Fix it by reading the parent pointer before destroying the blkcg's blkg's.
- Severity
- high
- Software
- Kernel
- Fixed in
- 6.12.6
- Published
- 2024-12-27
Affected versions
From: 6.7
Until: 6.12.6
Fixed in: 6.12.6
How to fix this CVE
Update your Linux kernel to version 6.12.6 or later to resolve a use-after-free vulnerability in the block device cgroup hierarchy management. This critical memory safety issue could allow local attackers with appropriate privileges to trigger kernel memory corruption. Apply the patch immediately, especially on systems running kernel versions 6.7 through 6.12.5.
sudo dnf update kernel kernel-develDefensia detects this vulnerability
How to check if you are affected
- Step 1: Check installed kernel version with `uname -r` and compare against vulnerable range 6.7.x–6.12.5
- Step 2: Verify blk-cgroup module is loaded with `lsmod | grep blk_cgroup` or check `/sys/module/blk_cgroup/`
- Step 3: Search kernel logs for UAF indicators with `sudo journalctl -k | grep -i 'kasan\|use-after-free\|blkcg'` or `sudo dmesg | grep -i 'kasan\|use-after-free'`
- Step 4: After patching, reboot the system with `sudo reboot` and verify new kernel version with `uname -r` to confirm 6.12.6 or later is running
FAQ
What is CVE-2024-56672?
This is a use-after-free vulnerability in Linux kernel's block device cgroup (blk-cgroup) subsystem where the parent block cgroup pointer is accessed after the cgroup object has been freed, potentially allowing memory corruption or denial of service.
Is CVE-2024-56672 being actively exploited?
No, CVE-2024-56672 is not listed in the CISA KEV catalog and has no public exploits available. However, the vulnerability requires crafted timing and kernel module interactions to trigger reliably.
What versions of Kernel are affected by CVE-2024-56672?
Linux kernel versions 6.7 through 6.12.5 are vulnerable. The fix is included in kernel 6.12.6 and later stable releases.
How do I check if my server is vulnerable to CVE-2024-56672?
Run `uname -r` and check if the output shows a kernel version between 6.7 and 6.12.5 (inclusive). If yes, your system is vulnerable and requires immediate patching.
Does Defensia detect CVE-2024-56672?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Linux kernel is installed on a monitored server running versions 6.7–6.12.5, CVE-2024-56672 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
- https://git.kernel.org/stable/c/29d1e06560f0f6179062ac638b4064deb637d1ad
- https://git.kernel.org/stable/c/5baa28569c924d9a90d036c2aaab79f791fedaf8
- https://git.kernel.org/stable/c/64afc6fe24c9896c0153e5a199bcea241ecb0d5c
- https://git.kernel.org/stable/c/83f5a87ee8caa76a917f59912a74d6811f773c67
- https://git.kernel.org/stable/c/86e6ca55b83c575ab0f2e105cf08f98e58d3d7af
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-56672. Free for 1 server.
Get started free