In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop<\/p>\n
rtl8xxxu arms rx_urb_wq from the RX completion path:
\nrtl8xxxu_rx_complete() hands the URB to rtl8xxxu_queue_rx_urb(), which
\nqueues it on rx_urb_pending_list and, once the list grows past
\nRTL8XXXU_RX_URB_PENDING_WATER, schedules rx_urb_wq. The worker
\nrtl8xxxu_rx_urb_work() drains rx_urb_pending_list, recovers priv through
\ncontainer_of, and resubmits each URB through rtl8xxxu_submit_rx_urb(),
\nwhich anchors it on rx_anchor and dereferences priv->udev.<\/p>\n
rtl8xxxu_stop() cancels the sibling work items (c2hcmd_work, ra_watchdog,
\nupdate_beacon_work) but never cancels rx_urb_wq, so a worker armed during
\nthe last burst of RX traffic can run rtl8xxxu_rx_urb_work() after
\nrtl8xxxu_disconnect() has called ieee80211_free_hw(), which frees priv,
\nproducing a use-after-free. The window opens under active RX traffic
\n(pending count above the watermark) followed by a disconnect.<\/p>\n
There are two teardown races to close:<\/p>\n
* rtl8xxxu_queue_rx_urb() decided whether to enqueue under rx_urb_lock
\n but called schedule_work() after dropping the lock. A completion
\n that observed shutdown == false and released the lock could then call
\n schedule_work() after rtl8xxxu_stop() had set shutdown and
\n cancel_work_sync() had already returned, arming the worker to run
\n after the teardown. Move schedule_work() under the same !shutdown
\n branch so the arming decision is atomic with the shutdown check.<\/p>\n
* rtl8xxxu_rx_urb_work() anchors every URB it drained back onto
\n rx_anchor through rtl8xxxu_submit_rx_urb(). A worker still running
\n when usb_kill_anchored_urbs(&priv->rx_anchor) returned would submit a
\n URB that escaped the kill. In rtl8xxxu_stop(), call
\n cancel_work_sync(&priv->rx_urb_wq) before the kill so the worker is
\n drained first.<\/p>\n
After priv->shutdown is set under rx_urb_lock, completions can no longer
\nqueue rx_urb_wq. cancel_work_sync() then drains the last queued or running
\nworker, and the following usb_kill_anchored_urbs() kills the URBs it may
\nhave submitted.<\/p>\n
rtl8xxxu_disconnect() is covered because ieee80211_unregister_hw()
\nguarantees .stop() runs for a live interface before ieee80211_free_hw()
\nfrees priv. The probe error path needs no cancel: rx_urb_wq is
\nINIT_WORK()’d there but cannot have been scheduled, since no URB is
\nsubmitted before ieee80211_register_hw() succeeds.<\/p>\n
This bug was found by static analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop<\/p>\n
rtl8xxxu arms rx_urb_wq from the RX completion path:
\nrtl8xxxu_rx_complet<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21280","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}