In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vxlan: do not arm the ageing timer on a device that is down<\/p>\n
vxlan_changelink() arms vxlan->age_timer whenever the requested ageing
\ninterval differs from the configured one:<\/p>\n
\tif (conf.age_interval != vxlan->cfg.age_interval)
\n\t\tmod_timer(&vxlan->age_timer, jiffies);<\/p>\n
There is no netif_running() test, so the timer is armed even on a device
\nthat was never brought up. The only synchronous cancel in the driver is
\nthe timer_delete_sync() in vxlan_stop(), which is .ndo_stop.
\nnetif_close_many() drops devices without IFF_UP before
\n__dev_close_many() runs, so that cancel is skipped for such a device.<\/p>\n
vxlan_setup() sets dev->needs_free_netdev = true and age_timer is a
\nmember of struct vxlan_dev, so free_netdev() releases the allocation the
\ntimer lives in while it is still queued on a timer_base.
\nexpire_timers() unlinks the entry before it loads timer->function, so
\nthe timer core writes through the freed object’s list pointers:<\/p>\n
BUG: KASAN: slab-use-after-free in __run_timers+0x208\/0x654
\n Write of size 8 at addr ffff00001adace68 by task true\/192
\n __asan_store8+0x84\/0xac
\n __run_timers+0x208\/0x654
\n run_timer_softirq+0x154\/0x18c
\n Allocated by task 189:
\n alloc_netdev_mqs+0x64\/0x720
\n rtnl_create_link+0x4ac\/0x520
\n rtnl_newlink+0x758\/0xd00
\n Freed by task 191:
\n netdev_release+0x40\/0x58
\n netdev_run_todo+0x4a4\/0x8c0
\n rtnl_dellink+0x200\/0x4e8<\/p>\n
The rtnl operations involved are netns-scoped, so an unprivileged user
\ncan perform them in a new user and network namespace.<\/p>\n
Arming the timer on a down device never had an effect: vxlan_cleanup()
\nreturns early on !netif_running(), and vxlan_open() arms the timer for
\nany non-zero interval once the device is brought up. Add the missing
\ntest.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vxlan: do not arm the ageing timer on a device that is down<\/p>\n
vxlan_changelink() arms vxlan->age_timer whenever the requested ageing<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11221","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}