Description
In the Linux kernel, the following vulnerability has been resolved: fs/xattr: missing fdput() in fremovexattr error path In the Linux kernel, the fremovexattr() syscall calls fdget() to acquire a file reference but returns early without calling fdput() when strncpy_from_user() fails on the name argument. In multi-threaded processes where fdget() takes the slow path, this permanently leaks one file reference per call, pinning the struct file and associated kernel objects in memory. An unprivileged local user can exploit this to cause kernel memory exhaustion. The issue was inadvertently fixed by commit a71874379ec8 ("xattr: switch to CLASS(fd)").
Product status
c03185f4a23e7f89d84c9981091770e876e64480 (git) before 9a3a2ae5efbbcaed37551218abed94e23c537157
c3a5e3e872f3688ae0dc57bb78ca633921d96a91 (git) before d151b94967c8247005435b63fc60f8f4baa320da
c3a5e3e872f3688ae0dc57bb78ca633921d96a91 (git) before a71874379ec8c6e788a61d71b3ad014a8d9a5c08
8d5863cb33aa424fc27115ee945ad6b96ae2facb (git)
6.11
Any version before 6.11
6.6.133 (semver)
6.12.77 (semver)
6.13 (original_commit_for_fix)
References
git.kernel.org/...c/9a3a2ae5efbbcaed37551218abed94e23c537157
git.kernel.org/...c/d151b94967c8247005435b63fc60f8f4baa320da
git.kernel.org/...c/a71874379ec8c6e788a61d71b3ad014a8d9a5c08