In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf, sockmap: Fix sk_redir use-after-free in send verdict<\/p>\n
sk_psock_msg_verdict() takes a socket reference for psock->sk_redir.
\ntcp_bpf_send_verdict() copies that pointer while holding the source socket
\nlock, but does not take a reference for the local copy before dropping the
\nlock around tcp_bpf_sendmsg_redir().<\/p>\n
When apply_bytes keeps the cached verdict active, another sendmsg() on the
\nsame source socket can consume the remaining bytes and release the cached
\nreference while the first thread still holds only the raw local pointer:<\/p>\n
CPU 0 CPU 1
\n sk_redir = psock->sk_redir
\n apply_bytes remains nonzero
\n release_sock(sk)
\n lock_sock(sk)
\n apply_bytes reaches zero
\n psock->sk_redir = NULL
\n release_sock(sk)
\n tcp_bpf_sendmsg_redir(sk_redir)
\n sock_put(sk_redir)
\n tcp_bpf_sendmsg_redir(sk_redir)<\/p>\n
The final sock_put() can free sk_redir before CPU 0 dereferences it.<\/p>\n
KASAN reported:<\/p>\n
BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39\/0x1020
\n Read of size 8 at addr ffff888108537090 by task poc\/87
\n Call Trace:
\n tcp_bpf_sendmsg_redir+0xf39\/0x1020
\n tcp_bpf_sendmsg+0x977\/0x1a50
\n __sys_sendto+0x32c\/0x3a0
\n __x64_sys_sendto+0xdb\/0x1b0
\n Allocated by task 85:
\n sk_prot_alloc+0x56\/0x210
\n sk_clone+0x6f\/0x14b0
\n inet_csk_clone_lock+0x24\/0x740
\n tcp_create_openreq_child+0x25\/0x2710
\n tcp_v4_syn_recv_sock+0x10a\/0xe00
\n Freed by task 0:
\n __kasan_slab_free+0x43\/0x70
\n slab_free_after_rcu_debug+0xa6\/0x1e0
\n rcu_core+0x50a\/0x1850
\n Last potentially related work creation:
\n __sk_destruct+0x3da\/0x540
\n sk_psock_destroy+0x81e\/0xab0
\n process_one_work+0x63a\/0x1070<\/p>\n
Take a temporary socket reference while the source socket lock still
\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()
\nreturns. This keeps each unlocked use independent of cached-verdict
\nownership.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf, sockmap: Fix sk_redir use-after-free in send verdict<\/p>\n
sk_psock_msg_verdict() takes a socket reference for psock->sk_redir.
\ntcp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11200","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}