In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()<\/p>\n
reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto
\nthe ehash chain, drops the bucket lock, and only afterwards sets
\nrsk_refcnt to 3.<\/p>\n
Lockless readers such as __inet_lookup_established() handle this with
\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain
\nsock_hold() while holding the bucket lock, on the assumption that the
\nlock guarantees sk_refcnt > 0. That assumption does not hold for
\nrequest_sock:<\/p>\n
CPU 0 CPU 1
\n —– —–
\n tcp_conn_request()
\n reqsk_queue_hash_req()
\n inet_ehash_insert(req)
\n spin_lock(bucket)
\n __sk_nulls_add_node_rcu(req) \/\/ rsk_refcnt == 0
\n spin_unlock(bucket)
\n bpf_iter_tcp_established_batch()
\n spin_lock(bucket)
\n sock_hold(req) rsk_refcnt, 3) \/\/ clobbers saturated value<\/p>\n
which surfaces as:<\/p>\n
refcount_t: addition on 0; use-after-free.
\n WARNING: lib\/refcount.c:25 at refcount_warn_saturate+0x48\/0x90, CPU#1
\n Call Trace:
\n bpf_iter_tcp_established_batch+0x14e\/0x170
\n bpf_iter_tcp_batch+0x53\/0x200
\n bpf_iter_tcp_seq_next+0x27\/0x70
\n bpf_seq_read+0x107\/0x410
\n vfs_read+0xb9\/0x380<\/p>\n
The iterator’s stolen reference is lost when the publishing CPU’s
\nrefcount_set() overwrites the count, leaving the socket one reference
\nshort. When the last legitimate owner drops its reference the reqsk is
\nfreed while still reachable, leading to use-after-free.<\/p>\n
This reproduces in seconds with tcp_syncookies=0, a handful of threads
\ndoing connect()\/close() to a local listener while others read an
\niter\/tcp link in a tight loop.<\/p>\n
Use refcount_inc_not_zero() and skip the socket on failure. A skipped
\nsocket is still part of the bucket, so keep counting it in expected.
\nThe reallocations are sized from expected, and a request sock whose
\nrefcount gets published while the lock is held across the last realloc
\nmust already have room.<\/p>\n
A skipped socket is counted in expected but never batched, so end_sk
\ncan be short of expected on a batch that is actually complete. Decide
\ncompleteness by whether the walk left any socket behind instead. The
\nWARN after the locked realloc checks the same, replacing an
\nend_sk == expected check that could not hold on that path since
\ncommit cdec67a489d4 (“bpf: tcp: Make sure iter->batch always
\ncontains a full bucket snapshot”).<\/p>\n
If every matching socket in a bucket is mid-init (refcount 0), end_sk
\nstays 0. Advance to the next bucket rather than returning a batch entry
\nthat was never filled this round.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()<\/p>\n
reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11282","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11282","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11282"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11282"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11282"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}