In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ovpn: skip rehash for peers already removed from by_id<\/p>\n
ovpn_nl_peer_set_doit() resolves the target peer via
\novpn_peer_get_by_id() before taking ovpn->lock. In the window between
\nthe lookup (which only takes a refcount) and the subsequent
\nspin_lock_bh(&ovpn->lock), a concurrent OVPN_CMD_PEER_DEL, keepalive
\nexpiry, or socket teardown can take ovpn->lock first, run
\novpn_peer_remove() to unhash the peer from all four tables (by_id,
\nby_vpn_addr4\/6, by_transp_addr) and release the lock. set_doit then
\nacquires ovpn->lock and calls ovpn_peer_hash_vpn_ip(), which
\nre-inserts the now-removed peer back into the rehashing tables.<\/p>\n
The same race affects the float path: ovpn_peer_endpoints_update()
\nholds only a refcount and acquires ovpn->lock very late (after async
\nAEAD decrypt and a netlink notification), then rehashes the peer
\nin the by_transp_addr table.<\/p>\n
The resurrected peer becomes reachable again from the RX lookup
\n(ovpn_peer_get_by_transp_addr) and the TX VPN-IP lookup, even though
\nuserspace believes it is gone. Once the data-path refcount drops the
\npeer is freed via call_rcu while the hash entries embedded in it
\nremain linked, opening a UAF window.<\/p>\n
Bail out of the rehash when hash_entry_id is unhashed, mirroring
\nthe sentinel already used by ovpn_peer_remove() to detect the
\nalready-removed state. The check is safe under ovpn->lock, which
\nserializes every mutation of hash_entry_id, and is a no-op for the
\nadd path because ovpn_peer_add_mp() inserts hash_entry_id before
\ncalling ovpn_peer_hash_vpn_ip().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ovpn: skip rehash for peers already removed from by_id<\/p>\n
ovpn_nl_peer_set_doit() resolves the target peer via
\novpn_peer_get_by_id() <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11291","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11291","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11291"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11291"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11291"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}