In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: cls_route: fix fastmap use-after-free on filter<\/p>\n
The route4 classifier maintains a 16-slot fastmap cache that stores raw
\nstruct route4_filter pointers indexed by (id, iif). The reader
\n(route4_classify) populates this cache via route4_set_fastmap() for every
\nclassified packet that hits a filter. The writer (route4_delete,
\nroute4_change) clears the cache via route4_reset_fastmap() before
\nRCU-deferred kfree of the filter.<\/p>\n
This creates a UAF race:
\n 1. Reader walks the RCU-protected bucket chain, finds filter f
\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()
\n 3. Reader calls route4_set_fastmap() and writes f into the cache
\n *after* the writer’s reset, caching a pointer about to be freed
\n 4. After the RCU grace period, kfree(f) executes
\n 5. Next classified packet on the same (id, iif) tuple hits the stale
\n fastmap entry and reads f->res from freed memory<\/p>\n
Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a
\nconcurrent add\/delete stress test (provided by both zdi and Santosh).
\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap
\npaths.<\/p>\n
Fix:
\nIntroduce a per-filter boolean dying flag to suppress stale fastmap
\nrepublishing by in-flight readers.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: cls_route: fix fastmap use-after-free on filter<\/p>\n
The route4 classifier maintains a 16-slot fastmap cache that stores raw<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11117","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11117","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11117"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11117"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11117"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}