In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock<\/p>\n
list_for_each_entry() iterates ci->i_cap_flush_list but drops
\ni_ceph_lock to send cap messages. During the unlock window,
\nhandle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries
\nwith tid i_list.next
\non freed memory.<\/p>\n
The race timeline:<\/p>\n
__kick_flushing_caps() handle_cap_flush_ack()
\n ———————– ———————–
\n holds i_ceph_lock <—
\n iterates to cf (tid=10)
\n prepares FLUSH message
\n drops i_ceph_lock acquires i_ceph_lock
\n cf->tid(10) <= flush_tid(10),
\n detaches cf from i_cap_flush_list
\n drops i_ceph_lock
\n ceph_free_cap_flush(cf) <- frees it!
\n acquires i_ceph_lock i_list.next<\/p>\n
The cf was just sent by __kick_flushing_caps itself via __send_cap().
\nThe MDS may respond with FLUSH_ACK quickly enough that
\nhandle_cap_flush_ack() frees cf before __kick_flushing_caps can
\nfinish the iteration.<\/p>\n
Fix by converting to a manual while loop: save the next pointer
\nunder i_ceph_lock before dropping it, then use the saved pointer
\nafter reacquiring, so the potentially-freed cf is never accessed again.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock<\/p>\n
list_for_each_entry() iterates ci->i_cap_flush_list but dr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21577","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21577","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21577"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21577"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21577"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}