In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
openvswitch: Fix CT limit teardown use-after-free<\/p>\n
Packet processing uses CT limit state under RCU, while netns teardown
\nfrees that state under ovs_mutex. The CT limit pointer was neither removed
\nfrom readers nor protected by a grace period, allowing packet processing to
\ndereference the freed state.<\/p>\n
An unprivileged user can trigger this bug from a user and network
\nnamespace, causing a slab-use-after-free in ovs_ct_execute() when the
\nnetns is torn down.<\/p>\n
Publish the CT limit pointer through RCU, remove it before teardown, and
\nwait for readers before freeing its contents. Keep ovs_mutex around
\nindividual CT limit updates, and use the RCU read-side lock while GET
\ntraverses the RCU-protected limit lists.<\/p>\n
Netns teardown detaches the RCU-protected CT limit state in the pernet
\n.pre_exit callback while holding ovs_mutex. The pernet core guarantees an
\nRCU grace period between the .pre_exit and .exit callbacks, so the .exit
\ncallback completes the teardown without adding any extra synchronization.<\/p>\n
The netlink command handlers do not need NULL checks because the userspace
\nnetlink socket holds an active reference to its network namespace while a
\nrequest is processed. The per-netns exit path therefore cannot run
\nconcurrently with SET, DEL, or GET for that socket’s namespace.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
openvswitch: Fix CT limit teardown use-after-free<\/p>\n
Packet processing uses CT limit state under RCU, while netns teardown
\nfrees that<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21410","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}