In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vsock\/vmci: fix UAF when peer resets connection during handshake<\/p>\n
vmci_transport_recv_connecting_server() returned err = 0 for a peer
\nRST in its default switch arm:<\/p>\n
\terr = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL;<\/p>\n
That made vmci_transport_recv_listen() skip vsock_remove_pending(),
\nleaving the pending socket on the listener’s pending_links with
\nsk_state = TCP_CLOSE while destroy: still dropped the explicit
\nreference taken before schedule_delayed_work().<\/p>\n
One second later vsock_pending_work() observed is_pending=true and
\nperformed full cleanup: vsock_remove_pending() then the two trailing
\nsock_put(sk) calls — the first reached refcount 0 and __sk_freed
\nthe socket, and the second wrote into the freed object:<\/p>\n
BUG: KASAN: slab-use-after-free in refcount_warn_saturate
\n Write of size 4 at addr ffff88800b1cac80 by task kworker
\n Workqueue: events vsock_pending_work<\/p>\n
Treat peer RST like any other unexpected packet type (err = -EINVAL).
\nAll destroy: arms now return err < 0, so vmci_transport_recv_listen()
\nremoves pending from pending_links synchronously and
\nvsock_pending_work() takes the is_pending=false \/ !rejected branch,
\ndropping only its own work reference. This also closes the
\nmulti-packet race Sashiko reported on v2: pending is removed from
\nthe list before any subsequent packet can find it.<\/p>\n
The pre-existing sk_acceptq_removed() gap on the err 0\/100 patched.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vsock\/vmci: fix UAF when peer resets connection during handshake<\/p>\n
vmci_transport_recv_connecting_server() returned err = 0 for a pe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15084","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15084","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15084"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15084"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15084"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}