In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hdlc_ppp: sync per-proto timers before freeing hdlc state<\/p>\n
Each PPP control protocol (LCP\/IPCP\/IPV6CP) embedded in struct ppp
\nregisters a timer via timer_setup(). That struct ppp is the
\nhdlc->state allocation, which detach_hdlc_protocol() frees with kfree()
\nin both teardown paths: unregister_hdlc_device() and the re-attach inside
\nattach_hdlc_protocol().<\/p>\n
The ppp proto never registered a .detach callback, so
\ndetach_hdlc_protocol() performs no timer synchronization before the
\nkfree(). The only cancel, timer_delete(&proto->timer) in ppp_cp_event(),
\nis partial (it does not wait for a running callback) and only runs on the
\n->CLOSED transition; ppp_stop()\/ppp_close() do not sync either. A
\nppp_timer callback already executing (blocked on ppp->lock) survives the
\nkfree and then dereferences proto->state \/ ppp->lock in freed memory,
\nleading to a use-after-free.<\/p>\n
Fix this by adding a .detach helper that calls timer_shutdown_sync() on
\nevery per-proto timer. detach_hdlc_protocol() invokes proto->detach(dev)
\nbefore kfree(hdlc->state), so timer_shutdown_sync()
\nnow runs on both free paths.
\ntimer_shutdown_sync() is used instead of timer_delete_sync() because the
\nkeepalive path re-arms the timer through add_timer()\/mod_timer() and
\nshutdown blocks any re-activation during teardown.<\/p>\n
Initialize the per-protocol timers in ppp_ioctl() when the protocol is
\nattached, and remove the now-redundant timer_setup() from ppp_start(), so
\nthat the timers are initialized exactly once at attach time and
\nppp_timer_release() never operates on uninitialized timer_list
\nstructures. attach_hdlc_protocol() uses kmalloc() (not kzalloc), so
\nstruct ppp’s protos[i].timer is uninitialized garbage until the first
\ntimer_setup(); without this init-at-attach, attaching the PPP protocol
\nwithout ever bringing the device up would leave timer_shutdown_sync()
\noperating on uninitialized memory in .detach. Moving the init out of
\nppp_start() (which only runs on NETDEV_UP) into the attach path makes the
\ninitialization unconditional and avoids initializing the same timer_list
\ntwice.<\/p>\n
This bug was found by static analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hdlc_ppp: sync per-proto timers before freeing hdlc state<\/p>\n
Each PPP control protocol (LCP\/IPCP\/IPV6CP) embedded in struct ppp
\nregis<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14880","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14880","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}