In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bridge: mcast: Fix a possible use-after-free when removing a bridge port<\/p>\n
When per-VLAN multicast snooping is enabled, the bridge iterates over
\nall the bridge ports, disables the per-port multicast context on each
\nport and enables the per-{port, VLAN} multicast contexts instead. The
\nreverse happens when per-VLAN multicast snooping is disabled.<\/p>\n
When global multicast snooping is enabled, the bridge iterates over all
\nthe bridge ports and enables the per-port multicast context on each
\nport. The reverse happens when multicast snooping is disabled.<\/p>\n
The above scheme can result in a situation where both types of contexts
\n(per-port and per-{port, VLAN}) are enabled on a single bridge port:<\/p>\n
# ip link add name br1 up type bridge mcast_snooping 1 mcast_querier 1 vlan_filtering 1
\n # ip link add name dummy1 up master br1 type dummy
\n # ip link set dev br1 type bridge mcast_vlan_snooping 1
\n # ip link set dev br1 type bridge mcast_snooping 0
\n # ip link set dev br1 type bridge mcast_snooping 1<\/p>\n
This is not intended and it is a problem since the commit cited below.
\nPrior to this commit, when removing a bridge port,
\nbr_multicast_disable_port() would disable the per-port multicast context
\nand the per-{port, VLAN} multicast contexts would get disabled when
\nflushing VLANs.<\/p>\n
After this commit, br_multicast_disable_port() only disables the
\nper-port multicast context if per-VLAN multicast snooping is disabled.
\nIf both types of contexts were enabled on the port when it was removed,
\nthe per-port multicast context would remain enabled when freeing the
\nbridge port, leading to a use-after-free [1].<\/p>\n
Fix by preventing the bridge from enabling \/ disabling the per-port
\nmulticast contexts when toggling global multicast snooping if per-VLAN
\nmulticast snooping is enabled.<\/p>\n
[1]
\nODEBUG: free active (active state 0) object: ffff88810f8bda78 object type: timer_list hint: br_ip6_multicast_port_query_expired (net\/bridge\/br_multicast.c:1927)
\nWARNING: lib\/debugobjects.c:629 at debug_print_object+0x1b1\/0x3e0, CPU#5: swapper\/5\/0
\n[…]
\nCall Trace:<\/p>\n
__debug_check_no_obj_freed (lib\/debugobjects.c:1116)
\nkfree (mm\/slub.c:2620 mm\/slub.c:6250 mm\/slub.c:6565)
\nkobject_cleanup (lib\/kobject.c:689)
\nrcu_do_batch (kernel\/rcu\/tree.c:2617)
\nrcu_core (kernel\/rcu\/tree.c:2869)
\nhandle_softirqs (kernel\/softirq.c:622)
\n__irq_exit_rcu (kernel\/softirq.c:656 kernel\/softirq.c:496 kernel\/softirq.c:735)
\nirq_exit_rcu (kernel\/softirq.c:752)
\nsysvec_apic_timer_interrupt (arch\/x86\/kernel\/apic\/apic.c:1061 (discriminator 47) arch\/x86\/kernel\/apic\/apic.c:1061 (discriminator 47))<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bridge: mcast: Fix a possible use-after-free when removing a bridge port<\/p>\n
When per-VLAN multicast snooping is enabled, the bridge i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15024","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15024","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15024"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15024"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15024"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}