In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: hsr: defer node table free until after RCU readers<\/p>\n
HSR node-list and node-status generic-netlink operations run under
\nrcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and
\nhsr_get_node_data(), but RTM_DELLINK teardown removes the same node table
\nwith plain list_del() and frees each node immediately.<\/p>\n
That lets a generic-netlink reader hold a struct hsr_node pointer across
\nhsr_dellink(). In a KASAN build, widening the reader window after
\nhsr_get_next_node() obtains the node reproduces a slab-use-after-free
\nwhen the reader copies node->macaddress_A; the freeing stack is
\nhsr_del_nodes() from hsr_dellink().<\/p>\n
Use list_del_rcu() and defer the free through the existing
\nhsr_free_node_rcu() callback. This matches the lifetime rule used by the
\nHSR prune paths, which already delete nodes with list_del_rcu() and
\ncall_rcu().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: hsr: defer node table free until after RCU readers<\/p>\n
HSR node-list and node-status generic-netlink operations run under
\nrcu_rea<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15090","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15090","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15090"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15090"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15090"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}