In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ip: orphan prefetched skbs before multicast forwarding<\/p>\n
IPv4 and IPv6 input preserve an skb->sk association installed by
\nbpf_sk_assign() so that local delivery can use the selected socket under
\nRCU. Both address families can also prefetch a socket in UDP early demux.
\nIn both paths (BPF and UDP early demux) a reference is not guaranteed to
\nbe held on the socket.<\/p>\n
When a multicast packet is not locally deliverable, IPv6 hands the
\noriginal skb to ip6_mr_input(). IPv4’s ip_mr_input() similarly keeps the
\noriginal skb when local delivery is not needed. Either path can put the
\nskb on an unresolved multicast route queue or forward it after the
\nreceive-side RCU section ends.<\/p>\n
After the prefetched socket is destroyed, a later skb free invokes
\nsock_pfree() and dereferences the stale skb->sk. Orphan the skb before
\neach non-local multicast forwarding path. Local delivery retains the
\noriginal skb; the existing skb_clone() calls provide multicast forwarding
\nwith a socket-free clone.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ip: orphan prefetched skbs before multicast forwarding<\/p>\n
IPv4 and IPv6 input preserve an skb->sk association installed by
\nbpf_sk_ass<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21486","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21486","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21486"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21486"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21486"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}