In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ovpn: respect peer refcount in CMD_NEW_PEER error path<\/p>\n
ovpn_nl_peer_new_doit()’s error path calls ovpn_peer_release() directly
\nrather than ovpn_peer_put(), bypassing the kref. The accompanying
\ncomment (“peer was not yet hashed, thus it is not used in any context”)
\nholds for UDP but not for TCP.<\/p>\n
For UDP, the ovpn_socket union uses the .ovpn arm and never points back
\nat a peer; UDP encap_recv looks up peers via the not-yet-populated
\nhashtables, so the new peer is unreachable until ovpn_peer_add()
\npublishes it.<\/p>\n
For TCP, ovpn_socket_new() sets ovpn_sock->peer and
\novpn_tcp_socket_attach() publishes ovpn_sock via rcu_assign_sk_user_data().
\nFrom that moment until ovpn_socket_release() detaches in the error path,
\nthe TCP fd is fully wired: userspace recvmsg \/ sendmsg \/ close \/ poll
\non the fd, as well as the strparser-driven ovpn_tcp_rcv() path, can
\nreach the peer through sk_user_data -> ovpn_sock->peer and bump its
\nrefcount via ovpn_peer_hold().<\/p>\n
ovpn_tcp_socket_wait_finish() (called inside ovpn_socket_release())
\ndrains strparser and the tx work, but does not synchronize with
\nuserspace syscall callers that already hold a peer reference. If
\novpn_nl_peer_modify() or ovpn_peer_add() returns an error while such
\na caller is in flight – notably an ovpn_tcp_recvmsg() blocked in
\n__skb_recv_datagram() on peer->tcp.user_queue – the direct
\novpn_peer_release() destroys the peer while the caller still holds
\nthe reference, and the eventual ovpn_peer_put() from that caller
\noperates on freed memory.<\/p>\n
Replace the direct destructor call with ovpn_peer_put() so the kref
\ncorrectly defers destruction until the last reference is dropped.
\nIn the common case where no concurrent user is present, behaviour is
\nunchanged: the kref hits zero immediately and ovpn_peer_release_kref()
\nruns the same destructor.<\/p>\n
With this conversion ovpn_peer_release() has no callers outside peer.c
\n– ovpn_peer_release_kref() in the same translation unit is the only
\nremaining user – so make it static and drop its declaration from
\npeer.h.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ovpn: respect peer refcount in CMD_NEW_PEER error path<\/p>\n
ovpn_nl_peer_new_doit()’s error path calls ovpn_peer_release() directly
\nrat<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15033","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15033","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15033"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15033"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15033"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}