In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: sch_teql: restore skb->dev on the slave failure path<\/p>\n
teql_master_xmit() sets skb->dev = slave before calling the slave’s
\nndo_start_xmit(), but never restores it when that transmit fails. The
\nskb then walks on to the next slave still pointing at the previous one.<\/p>\n
If a later slave has no resolved neighbour, teql_resolve() hands the skb
\nto neigh_event_send(), which queues it on that neighbour’s arp_queue
\nwith the stale skb->dev. skb->dev holds no reference, so deleting the
\nprevious slave frees the net_device while the skb is still queued.
\nWhatever runs next on that skb – arp_error_report() on timeout, or
\nneigh_direct_output() -> dev_queue_xmit() once the neighbour resolves –
\ncauses a UAF like the one below:<\/p>\n
BUG: KASAN: slab-use-after-free in __icmp_send (net\/ipv4\/icmp.c:914 (discriminator 2))
\nRead of size 4 at addr ffff888106e100b0 by task flood_packet\/527
\nCPU: 0 UID: 0 PID: 527 Comm: flood_packet Not tainted 7.2.0-rc6-g594d90519502 #1 PREEMPT(lazy)
\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\nCall Trace:<\/p>\n
dump_stack_lvl (lib\/dump_stack.c:94 lib\/dump_stack.c:120)
\nprint_report (mm\/kasan\/report.c:378 mm\/kasan\/report.c:482)
\n? __pfx__raw_spin_lock_irqsave (.\/include\/asm-generic\/qrwlock.h:122 (discriminator 4))
\n? __icmp_send (net\/ipv4\/icmp.c:914 (discriminator 2))
\nkasan_report (mm\/kasan\/report.c:595)
\n? __icmp_send (net\/ipv4\/icmp.c:914 (discriminator 2))
\n__icmp_send (net\/ipv4\/icmp.c:914 (discriminator 2))
\n[…]
\nipv4_link_failure (net\/ipv4\/route.c:1251 net\/ipv4\/route.c:1258)
\n? __pfx_ipv4_link_failure (.\/include\/linux\/skbuff.h:4327)
\n? _raw_write_lock (.\/include\/linux\/instrumented.h:55 .\/include\/linux\/atomic\/atomic-instrumented.h:1301 .\/include\/asm-generic\/qrwlock.h:98 .\/include\/linux\/rwlock_api_smp.h:230 kernel\/locking\/spinlock.c:304)
\n? __pfx__raw_write_lock (kernel\/locking\/spinlock.c:175)
\narp_error_report (.\/include\/net\/dst.h:438 net\/ipv4\/arp.c:296)
\nneigh_invalidate (net\/core\/neighbour.c:1077)
\nneigh_timer_handler (net\/core\/neighbour.c:1169)
\n[…]
\nAllocated by task 505:
\nkasan_save_stack (mm\/kasan\/common.c:57)
\nkasan_save_track (mm\/kasan\/common.c:78)
\n__kasan_kmalloc (mm\/kasan\/common.c:398 mm\/kasan\/common.c:415)
\n__kvmalloc_node_noprof (.\/include\/linux\/kasan.h:263 mm\/slub.c:5334 mm\/slub.c:6905)
\nalloc_netdev_mqs (net\/core\/dev.c:12055 (discriminator 2))
\nrtnl_create_link (net\/core\/rtnetlink.c:3721)
\nrtnl_newlink (net\/core\/rtnetlink.c:3903 net\/core\/rtnetlink.c:4044 net\/core\/rtnetlink.c:4159)
\nrtnetlink_rcv_msg (net\/core\/rtnetlink.c:7076)
\n[…]
\nFreed by task 536:
\nkasan_save_stack (mm\/kasan\/common.c:57)
\nkasan_save_track (mm\/kasan\/common.c:78)
\nkasan_save_free_info (mm\/kasan\/generic.c:584)
\n__kasan_slab_free (mm\/kasan\/common.c:253 mm\/kasan\/common.c:285)
\nkfree (.\/include\/linux\/kasan.h:235 mm\/slub.c:2677 mm\/slub.c:6377 mm\/slub.c:6692)
\ndevice_release (drivers\/base\/core.c:2636)
\nkobject_put (lib\/kobject.c:689 lib\/kobject.c:720 .\/include\/linux\/kref.h:65 lib\/kobject.c:737)
\nnetdev_run_todo (net\/core\/dev.c:11756)
\nrtnl_dellink (net\/core\/rtnetlink.c:157 .\/include\/linux\/rtnetlink.h:135 net\/core\/rtnetlink.c:3651)
\nrtnetlink_rcv_msg (net\/core\/rtnetlink.c:7076)
\n[…]<\/p>\n
Fix this by restoring skb->dev to the master at the end of each slave’s
\niteration.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: sch_teql: restore skb->dev on the slave failure path<\/p>\n
teql_master_xmit() sets skb->dev = slave before calling the slave’<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25480","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25480","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25480"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25480"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25480"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}