In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
slip: fix use-after-free in sl_sync()<\/p>\n
slip_devs[] stores bare net_device pointers and takes no reference on
\nthem. sl_sync() and sl_alloc() walk that table from slip_open() under
\nrtnl_lock(), while an entry is dropped by sl_free_netdev(), which
\nsl_setup() installs as dev->priv_destructor.<\/p>\n
priv_destructor is called from netdev_run_todo(), which deliberately
\nruns with the RTNL semaphore released so that it can sleep while waiting
\nfor the device refcount to drop:<\/p>\n
\t\/* Snapshot list, allow later requests *\/
\n\tlist_replace_init(&net_todo_list, &list);<\/p>\n
\t__rtnl_unlock();
\n\t…
\n\t\tif (dev->priv_destructor)
\n\t\t\tdev->priv_destructor(dev);\t\/* slip_devs[i] = NULL *\/
\n\t\tif (dev->needs_free_netdev)
\n\t\t\tfree_netdev(dev);
\n\t\t…
\n\t\t\/* Free network device *\/
\n\t\tkobject_put(&dev->dev.kobj);<\/p>\n
So rtnl_lock() does not serialise slip_open() against the teardown at
\nall. sl_sync() can load slip_devs[i] while the entry is still published
\nand dereference it after netdev_run_todo() has run the destructor and
\nreleased the device:<\/p>\n
CPU0 (slip_open) CPU1 (slip_close)
\n unregister_netdev()
\n rtnl_unlock()
\n netdev_run_todo()
\n __rtnl_unlock()
\n rtnl_lock()
\n sl_sync()
\n dev = slip_devs[i]
\n priv_destructor(dev)
\n slip_devs[i] = NULL
\n kobject_put(&dev->dev.kobj)
\n \/* dev is freed *\/
\n sl = netdev_priv(dev)
\n if (sl->tty || sl->leased) \/* use-after-free *\/<\/p>\n
BUG: KASAN: use-after-free in sl_sync drivers\/net\/slip\/slip.c:730 [inline]
\n BUG: KASAN: use-after-free in slip_open+0xef4\/0x1210 drivers\/net\/slip\/slip.c:806
\n Read of size 1 at addr ffff8880712dac71 by task syz-executor.2\/6506<\/p>\n
CPU: 2 PID: 6506 Comm: syz-executor.2 Not tainted 6.1.134-syzkaller-00260-g0c8fc3469765 #0
\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04\/01\/2014
\n Call Trace:
\n sl_sync drivers\/net\/slip\/slip.c:730 [inline]
\n slip_open+0xef4\/0x1210 drivers\/net\/slip\/slip.c:806
\n tty_ldisc_open+0xa2\/0x120 drivers\/tty\/tty_ldisc.c:433
\n tty_set_ldisc+0x324\/0x720 drivers\/tty\/tty_ldisc.c:564
\n tiocsetd drivers\/tty\/tty_io.c:2428 [inline]
\n tty_ioctl+0x5f0\/0x1530 drivers\/tty\/tty_io.c:2712<\/p>\n
Allocated by task 6502:
\n alloc_netdev_mqs+0x98\/0xfe0 net\/core\/dev.c:10719
\n sl_alloc drivers\/net\/slip\/slip.c:756 [inline]
\n slip_open+0x36d\/0x1210 drivers\/net\/slip\/slip.c:817
\n tty_ldisc_open+0xa2\/0x120 drivers\/tty\/tty_ldisc.c:433
\n tty_set_ldisc+0x324\/0x720 drivers\/tty\/tty_ldisc.c:564<\/p>\n
Freed by task 6497:
\n device_release+0xa2\/0x240 drivers\/base\/core.c:2507
\n kobject_put+0x179\/0x280 lib\/kobject.c:729
\n netdev_run_todo+0x6c8\/0xef0 net\/core\/dev.c:10509
\n slip_close+0x166\/0x1c0 drivers\/net\/slip\/slip.c:906
\n tty_ldisc_close+0x113\/0x1a0 drivers\/tty\/tty_ldisc.c:456
\n tty_ldisc_kill+0x94\/0x160 drivers\/tty\/tty_ldisc.c:614
\n tty_ldisc_release+0xe3\/0x2b0 drivers\/tty\/tty_ldisc.c:782
\n tty_release+0xbcc\/0xe70 drivers\/tty\/tty_io.c:1860<\/p>\n
Commit e58c19124189 (“slip: Fix use-after-free Read in slip_open”) fixed
\na different source of stale entries – a device left in slip_devs[] after
\nslip_open() freed it on the registration error path – and does not
\naddress this race, which is why the report survives it.<\/p>\n
Drop the entry from ndo_uninit instead. unregister_netdevice() calls
\nndo_uninit under RTNL, before the device is queued to netdev_run_todo(),
\nso an entry that sl_sync() can still see while holding RTNL belongs to a
\ndevice that cannot be freed until RTNL is dropped. sl_free_netdev()
\nstays only for the slip_open() error path, where register_netdevice()
\nmay have failed before ndo_init and ndo_uninit is then not called
\neither. Both running for the same device is harmless: the
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
slip: fix use-after-free in sl_sync()<\/p>\n
slip_devs[] stores bare net_device pointers and takes no reference on
\nthem. sl_sync() and s<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21334","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}