In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()<\/p>\n
Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read
\nin slip_receive_buf() when racing against tty hangup.<\/p>\n
tty_ldisc_hangup() calls ld->ops->hangup() while holding only
\na read lock on tty->ldisc_sem (via tty_ldisc_ref()).
\nBecause slip_hangup() simply called slip_close(), it ran concurrently
\nwith reader functions such as slip_receive_buf().<\/p>\n
slip_close() unregisters and frees the net device and its private
\nstruct slip, causing concurrent reader threads in slip_receive_buf()
\nto dereference freed memory.<\/p>\n
Line discipline close() is already guaranteed to be called under
\nthe write lock of tty->ldisc_sem during hangup processing
\n(in tty_ldisc_reinit() or tty_ldisc_kill()).<\/p>\n
Remove slip_hangup() so teardown is serialized cleanly by slip_close().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()<\/p>\n
Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-fre<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25466","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}