In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: mctp: hold a reference to the route device in mctp_route_lookup()<\/p>\n
mctp_route_lookup() uses rt->dev without holding a reference on it.
\nmctp_route_lookup_single() returns the route under RCU only, so the
\nroute’s device can be torn down concurrently: mctp_dev_put() drops the
\nlast reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr()
\nthen reads rt->dev->addrs[0], giving a use-after-free reachable by an
\nunprivileged local AF_MCTP user on the receive\/forwarding path (no
\nCAP_NET_RAW required):<\/p>\n
BUG: KASAN: slab-use-after-free in mctp_route_lookup
\n Read of size 1 at addr … by task mctp_uaf\/…
\n mctp_route_lookup
\n mctp_pkttype_receive
\n Freed by task …:
\n kfree
\n mctp_dev_put
\n mctp_dev_notify<\/p>\n
In the same window mctp_dst_from_route() -> mctp_dev_hold() also
\nincrements a refcount that has already reached zero
\n(“refcount_t: addition on 0 … mctp_dev_hold”).<\/p>\n
This reintroduces the use-after-free class of CVE-2023-3439: the source
\naddress lookup was moved ahead of the point where the destination takes
\nits device reference.<\/p>\n
Take a reference with refcount_inc_not_zero() before touching rt->dev,
\nskip a device that is already dead, and drop the reference once the
\ndestination has taken its own.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: mctp: hold a reference to the route device in mctp_route_lookup()<\/p>\n
mctp_route_lookup() uses rt->dev without holding a referenc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21328","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21328","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21328"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21328"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21328"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}