In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vsock\/virtio: flush works in dependency order<\/p>\n
virtio_vsock_remove() stops the virtqueues and then flushes each work
\nitem before freeing the enclosing virtio_vsock. The current order does
\nnot account for dependencies between those items: tx_work may queue
\nsend_pkt_work, and send_pkt_work may queue rx_work.<\/p>\n
In particular, send_pkt_work can set restart_rx and release tx_lock.
\nThe remove path can then stop the queues and flush rx_work before
\nsend_pkt_work queues it. Although the later send_pkt_work flush waits
\nfor that producer to finish, nothing waits for the newly queued rx_work,
\nso kfree(vsock) can race with it.<\/p>\n
KASAN reported:<\/p>\n
BUG: KASAN: slab-use-after-free in
\n virtio_transport_rx_work+0x487\/0x4b0
\n Read of size 8 at addr ffff888114c2b008 by task kworker\/1:1\/47
\n Workqueue: virtio_vsock virtio_transport_rx_work
\n Call Trace:
\n virtio_transport_rx_work+0x487\/0x4b0
\n process_one_work+0x688\/0x1120
\n worker_thread+0x45b\/0xd10
\n Allocated by task 1:
\n virtio_vsock_probe+0xef\/0x6b0
\n Freed by task 84:
\n kfree+0x131\/0x3c0
\n virtio_vsock_remove+0xd1\/0x100<\/p>\n
Flush the works in producer-to-consumer order. virtio_vsock_vqs_del()
\nhas already disabled the queue callbacks and cleared the run flags, so
\nafter tx_work and send_pkt_work are drained, no source remains that can
\nqueue rx_work after its flush.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vsock\/virtio: flush works in dependency order<\/p>\n
virtio_vsock_remove() stops the virtqueues and then flushes each work
\nitem before fr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21265","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}