In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: account classifier filter allocations to memcg<\/p>\n
Allocations in the tc classifier *_change() paths (filter objects,
\nper-CPU counters, and per-filter aux data) use plain GFP_KERNEL without
\n__GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside
\nmemcg charging. The shared tcf_exts_init_ex() action array allocation in
\ncls_api.c was also uncharged; this patch closes it along with the
\nper-classifier filter-object\/percpu\/aux allocations that remain
\nunaccounted.<\/p>\n
Add GFP_KERNEL_ACCOUNT to:
\n– the shared tcf_exts_init_ex() action array (cls_api.c), common to every
\n filter of every classifier (32 pointers, 256 bytes);
\n– the filter-object, per-CPU-counter, and per-filter aux allocations in
\n cls_basic, cls_bpf, cls_cgroup, cls_flow, cls_flower, cls_fw,
\n cls_matchall, cls_route and cls_u32;
\n– the u32_init_knode() replace-path knode allocation (cls_u32.c), which
\n allocates the same struct tc_u_knode + sel.keys on every replace of an
\n existing knode and was missed by the create-path-only conversion.<\/p>\n
Also fix the cls_basic error path: basic_change() inserts fnew into the
\nIDR before allocating the per-CPU counter. If alloc_percpu() fails the
\nerrout path kfree’d fnew without idr_remove, leaving a dangling pointer
\nin the IDR. With GFP_KERNEL_ACCOUNT the percpu alloc becomes failable
\non demand (memcg at memory.max), making the dead path attacker-reachable
\nand burning the handle permanently. Add the idr_remove on the percpu
\nfailure path, matching the basic_set_parms failure-path pattern.<\/p>\n
Note: vega@nebusec.ai provided a poc for basic_cls, but it was easy to
\nextend to the other classifiers.<\/p>\n
Conditions to recreate the bug:
\n– CONFIG_NET_SCHED, CONFIG_NET_CLS_* (the classifier being used),
\n CONFIG_NET_CLS_ACT, CONFIG_MEMCG, CONFIG_USER_NS, CONFIG_NET_NS.
\n– Unprivileged user in a fresh user+network namespace (unshare -Urn),
\n or root with CAP_NET_ADMIN.
\n– Create a large number of tc filters (e.g. tc filter add dev lo
\n ingress … …) while watching a memcg-limited cgroup:
\n system slab grows far faster than memory.current, pinning kernel
\n memory outside memcg charging.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: account classifier filter allocations to memcg<\/p>\n
Allocations in the tc classifier *_change() paths (filter objects,
\nper-C<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25508","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25508","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25508"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25508"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25508"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}