In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
security\/keys: fix missed RCU read section on lookup<\/p>\n
Nicholas Carlini reports that the keyring code calls assoc_array_find()
\nin find_key_to_update() without holding the RCU read lock, while the
\nassoc_array_gc() code really is designed around removing the node from
\nthe tree and then freeing it after an RCU grace-period.<\/p>\n
The regular key handling doesn’t see this because holding the keyring
\nsemaphore hides any lifetime issues, but the persistent key handling
\nuses a different model.<\/p>\n
Instead of extending the keyring locking, just do the simple RCU locking
\nthat the assoc_array was designed for.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
security\/keys: fix missed RCU read section on lookup<\/p>\n
Nicholas Carlini reports that the keyring code calls assoc_array_find()
\nin fi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15011","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15011","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15011"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15011"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15011"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}