In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix netns reference imbalance in conntrack kfuncs<\/p>\n
The opts argument of the BPF conntrack kfuncs can point to a shared
\nmap value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read
\nopts->netns_id separately when acquiring and releasing the network
\nnamespace reference.<\/p>\n
The reference imbalance can occur as follows:<\/p>\n
CPU 0 CPU 1
\n read opts->netns_id (-1)
\n skip get_net_ns_by_id()
\n write opts->netns_id (id)
\n read opts->netns_id (id)
\n put_net(net) \/* no matching get *\/<\/p>\n
The reverse transition leaks the reference. Repeating the unmatched put
\ncan destroy a live namespace and crash later users.<\/p>\n
The kernel reported:<\/p>\n
Oops: general protection fault, probably for non-canonical address
\n KASAN: null-ptr-deref in range [0x00000000000000e8-0x00000000000000ef]
\n RIP: 0010:bpf_prog_test_run_xdp+0x52c\/0x1700
\n Call Trace:
\n __sys_bpf+0x1662\/0x50c0
\n __x64_sys_bpf+0x73\/0xb0
\n do_syscall_64+0xf9\/0x540
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\n Kernel panic – not syncing: Fatal exception<\/p>\n
Snapshot every input field of opts with READ_ONCE() before validating or
\nusing it. The netns_id snapshot keeps the namespace get\/put pair
\nbalanced, while the other snapshots keep the remaining options from
\nchanging partway through an invocation. The individual reads can still
\nobserve an inconsistent combination during a concurrent update, but each
\nselected field value remains stable for that invocation.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix netns reference imbalance in conntrack kfuncs<\/p>\n
The opts argument of the BPF conntrack kfuncs can point to a shared
\nmap val<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11283","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}