In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
af_unix: Set gc_in_progress to true in unix_gc().<\/p>\n
Igor Ushakov reported that unix_gc() could run with gc_in_progress
\nbeing false if the work is scheduled while running:<\/p>\n
Thread 1 Thread 2 Thread 3
\n ——– ——– ——–
\n unix_schedule_gc() unix_schedule_gc()
\n `- if (!gc_in_progress) `- if (!gc_in_progress)
\n |- gc_in_progress = true |
\n `- queue_work() |
\n unix_gc() <—————-\/ |
\n | |- gc_in_progress = true
\n … `- queue_work()
\n | |
\n `- gc_in_progress = false |
\n |
\n unix_gc() <———————————————'
\n |
\n … \/* gc_in_progress == false *\/
\n |
\n `- gc_in_progress = false<\/p>\n
unix_peek_fpl() relies on gc_in_progress not to confuse GC
\nby MSG_PEEK.<\/p>\n
Let's set gc_in_progress to true in unix_gc().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
af_unix: Set gc_in_progress to true in unix_gc().<\/p>\n
Igor Ushakov reported that unix_gc() could run with gc_in_progress
\nbeing false i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12897","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12897","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12897"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12897"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12897"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}