In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: bridge: mcast: fix use-after-free of a master VLAN’s multicast context<\/p>\n
br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under
\nbr->multicast_lock before stopping a VLAN’s multicast context. That is
\nthe teardown handshake: lockless readers gate on the flag through
\nbr_multicast_ctx_should_use() -> br_multicast_ctx_vlan_disabled(), so
\nonce it is cleared under the lock no reader can arm the context again.<\/p>\n
For a master VLAN the handshake never runs. __vlan_del() clears
\nBRIDGE_VLAN_INFO_BRENTRY before calling br_vlan_put_master(), so
\nbr_multicast_toggle_one_vlan(masterv, false) returns early on
\n!br_vlan_is_brentry(vlan): the flag stays set and br->multicast_lock is
\nnever taken. br_vlan_put_master() then drains the context in
\nbr_multicast_ctx_deinit() and frees the VLAN through call_rcu(), while a
\nreader still inside rcu_read_lock() sees the context as enabled and
\nre-arms it. The port and port-VLAN branch of the function has no
\nbr_vlan_is_brentry() test and flips the flag under br->multicast_lock,
\nso it is not affected.<\/p>\n
The reader is the bridge transmit path. For a master VLAN
\nbr_multicast_rcv() selects brmctx = &vlan->br_mcast_ctx with
\npmctx = NULL, so IGMP sent to the bridge device re-arms the context’s
\ntimers after br_multicast_ctx_deinit() has already stopped them.<\/p>\n
BUG: KASAN: slab-use-after-free in detach_if_pending+0x412\/0x4a0
\n Write of size 8 at addr ffff88810ac39918 by task brmc\/601
\n __mod_timer+0x51a\/0xc50
\n br_multicast_host_join+0x25b\/0x390
\n __br_multicast_add_group+0x468\/0x530
\n br_ip4_multicast_add_group+0x1a0\/0x260
\n br_multicast_rcv+0x2cda\/0x61e0
\n br_dev_xmit+0x6c4\/0x1540
\n Allocated by task 610:
\n br_vlan_add+0x111\/0xb40
\n br_vlan_info+0x370\/0x3e0
\n Freed by task 0:
\n kfree+0x1a7\/0x4f0
\n rcu_core+0x7dc\/0x10a0<\/p>\n
Only test br_vlan_is_brentry() when enabling, like the
\nbr_multicast_ctx_vlan_global_disabled() test next to it. Disabling then
\nalways clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before
\nbr_multicast_ctx_deinit() drains the context.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: bridge: mcast: fix use-after-free of a master VLAN’s multicast context<\/p>\n
br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17346","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}