In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
packet: synchronize pressure clearing with ring reconfiguration<\/p>\n
packet_set_ring() updates the RX ring state under sk_receive_queue.lock,
\nbut used to publish the tpacket receive mode through po->prot_hook.func
\nafter releasing that lock. packet_poll() and packet_recvmsg() can then
\nrun the pressure clearing path after the ring has been cleared while
\nstill seeing tpacket_rcv, causing __packet_rcv_has_room() to dereference
\nstale or NULL ring storage.<\/p>\n
Move the existing receive hook assignment into the same
\nsk_receive_queue.lock section as the ring state update. Keep the
\nassignment otherwise unchanged, including on TX ring reconfiguration, to
\navoid adding behavior changes that are not required for the fix.<\/p>\n
Serialize packet_recvmsg() pressure clearing with the same queue lock
\nonly after PACKET_SOCK_PRESSURE has been observed. If the flag is clear
\nand the socket has moved away from tpacket_rcv, packet_set_ring() has
\nalready detached the socket and waited for synchronize_net(), so no new
\npacket input can set the flag again.<\/p>\n
packet_poll() already holds sk_receive_queue.lock, so it uses the new
\nunlocked helper directly.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
packet: synchronize pressure clearing with ring reconfiguration<\/p>\n
packet_set_ring() updates the RX ring state under sk_receive_queue<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11252","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}