Use-After-Free in Linux Kernel zram Module

Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's zram component, specifically in the function zram_bvec_write_partial().

The problem arises because zram_read_page() chooses between synchronous or asynchronous read paths based on whether the parent bio is NULL. In the affected code, zram_bvec_write_partial() passes its parent bio down, causing reads for certain slots (ZRAM_WB) to be dispatched asynchronously.

As a result, zram_read_page() returns 0 while the asynchronous read is still in progress. Meanwhile, the caller proceeds to run memcpy_from_bvec(), zram_write_page(), and __free_page() on the buffer, which leads to the asynchronous read writing into a page that has already been freed.

This issue was fixed by switching zram_bvec_read_partial() to pass a NULL parent bio to ensure synchronous reads, but the write_partial counterpart was initially missed and later corrected.

Useful 0 Not Useful 0

Impact Analysis

This use-after-free vulnerability can lead to memory corruption within the Linux kernel's zram subsystem.

Memory corruption may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges.

Because it involves asynchronous reads writing to freed memory, it could be exploited to compromise system security or cause denial of service.

Useful 0 Not Useful 0