In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/handshake: hand off the pinned file reference to accept_doit<\/p>\n
handshake_req_next() removes the request from the per-net
\npending list and drops hn_lock before handshake_nl_accept_doit()
\nreads req->hr_sk->sk_socket and dereferences sock->file (once in
\nFD_PREPARE() and again in get_file()). In that window a
\nconsumer running tls_handshake_cancel() followed by sockfd_put()
\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases
\nsock->file. sock_release() then runs sock_orphan(), zeroing
\nsk_socket, and frees the struct socket. The accept-side code
\neither reads NULL through sk_socket or chases freed memory.<\/p>\n
The submit-side sock_hold() does not prevent this. sk_refcnt
\nprotects struct sock, but struct socket and sock->file are
\nindependently refcounted via the file descriptor the consumer
\nowns. Pinning sk leaves sock and sock->file unprotected.<\/p>\n
Retarget the accept-side dereferences at req->hr_file, which was
\npinned at submit time, instead of req->hr_sk->sk_socket->file.
\nPinning on its own is not sufficient: a consumer that cancels
\nbetween handshake_req_next() returning and accept_doit reaching
\nFD_PREPARE() takes the !remove_pending() branch in
\nhandshake_req_cancel() and drops hr_file before the accept side
\ntakes its own reference. Hand off an additional file reference
\ninside handshake_req_next(), under hn_lock, so the accept side
\noperates on a reference that no concurrent handshake_req_cancel()
\ncan revoke. FD_PREPARE() consumes that handed-off reference,
\neither by transferring it to the new fd in fd_publish() or by
\ndropping it in the cleanup destructor on error; the explicit
\nget_file() that previously balanced FD_PREPARE() is therefore
\nredundant and goes away.<\/p>\n
Update handshake_req_cancel_test2 and _test3 to simulate the
\nFD_PREPARE() consumption with an fput() so the kunit file-count
\nassertions stay balanced.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/handshake: hand off the pinned file reference to accept_doit<\/p>\n
handshake_req_next() removes the request from the per-net
\npending<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14991","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14991","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14991"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14991"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14991"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}