In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
batman-adv: bla: avoid double decrement of bla.num_requests<\/p>\n
The bla.num_requests is increased when no request_sent was in progress. And
\nit is decremented in various places (announcement was received, backbone is
\npurged, periodic work). But the check if the request_sent is actually set
\nto a specific state and the atomic_dec\/_inc are not safe because they are
\nnot atomic (TOCTOU) and multiple such code portions can run concurrently.<\/p>\n
At the same time, it is necessary to modify request_sent (state) and
\nbla.num_requests atomically. Otherwise batadv_bla_send_request() might set
\nrequest_sent to 1 and is interrupted. batadv_handle_announce() can then
\nset request_sent back to 0 and decrement num_requests before
\nbatadv_bla_send_request() incremented it.<\/p>\n
The two operations must therefore be locked. And since state (request_sent)
\nand wait_periods are only accessed inside this lock, they can be converted
\nto simpler datatypes. And to avoid that the bla.num_requests is touched by
\na parallel running context with a valid backbone_gw reference after
\nbatadv_bla_purge_backbone_gw() ran, a third state “stopped” is required to
\ncorrectly signal that a backbone_gw is in the state of being cleaned up.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
batman-adv: bla: avoid double decrement of bla.num_requests<\/p>\n
The bla.num_requests is increased when no request_sent was in progress<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15069","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15069","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15069"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15069"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15069"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}