In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ixgbevf: fix use-after-free in VEPA multicast source pruning<\/p>\n
ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF’s
\nown address (VEPA multicast workaround) by freeing the skb and
\ncontinuing to the next descriptor:<\/p>\n
dev_kfree_skb_irq(skb);
\n continue;<\/p>\n
The skb pointer is declared outside the while loop and persists across
\niterations. Because the continue skips the “skb = NULL” reset at the
\nbottom of the loop, the next iteration enters the “else if (skb)” path
\nand calls ixgbevf_add_rx_frag() on the freed skb, dereferencing
\nskb_shinfo(skb)->nr_frags – a use-after-free in NAPI softirq context.<\/p>\n
The sibling driver iavf already handles this correctly by nulling the
\npointer before continuing. Apply the same pattern here.<\/p>\n
I do not have ixgbevf hardware; the bug was found by static analysis
\n(scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool
\ncorroboration with the highest score in the scan). The UAF was confirmed
\nunder KASAN by loading a test module that reproduces the exact code
\npattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags):<\/p>\n
BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100\/0x1000
\n Read of size 8 at addr 000000006163ae78 by task insmod\/30
\n freed 208-byte region [000000006163adc0, 000000006163ae90)<\/p>\n
QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF
\ndriver does not include the VEPA source pruning path, so a full
\nend-to-end reproduction with emulated hardware was not possible.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ixgbevf: fix use-after-free in VEPA multicast source pruning<\/p>\n
ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF’<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15082","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15082","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15082"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15082"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}