CVE-2024-56672

What it actually does

Use-after-free in blkcg_unpin_online() due to blkcg_parent() call after blkcg_destroy_blkgs() frees the blkcg object, allowing slab read of freed memory during cgwb_release workqueue processing.

Why it matters to the business

Linux kernel systems using block cgroups may experience crashes or potential local code execution under specific workload conditions, requiring urgent patching to maintain system stability and security.

How an attack unfolds

An attacker with local access crafts cgroup and block device operations that race blkcg destruction with cgwb_release work items; after multiple RCU grace periods the freed blkcg is dereferenced via blkcg_parent leading to KASAN-detected UAF that can be leveraged for kernel memory reads or writes.

How to fix it

Upgrade the Linux kernel to commit 83f5a87ee8caa76a917f59912a74d6811f773c67 or later stable releases containing the fix; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm kernel version contains the referenced commit; attempt to reproduce the original KASAN report with artificial delays removed to verify absence of UAF.

Typical attack path

1. Obtain local unprivileged access on affected Linux kernel
2. Create nested blkcg hierarchies and trigger cgwb_release paths
3. Force blkcg destruction while blkcg_unpin_online walks parents
4. Exploit freed memory read/write for privilege escalation or DoS

How to detect it

Search kernel logs and dmesg for KASAN reports citing blkcg_unpin_online+0x15a and slab-use-after-free at addresses in css_free paths; inspect workqueue traces for cgwb_release_workfn.

What your security team should do

• Prioritize kernel updates on all production Linux hosts within the next maintenance window
• Monitor for kernel oops or KASAN reports involving blkcg_unpin_online and cgwb_release
• Restrict unprivileged cgroup and block device manipulation where feasible until patched