In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
amt: Don’t support cross-netns setup.<\/p>\n
When a lower device is unregistered, amt_device_event() tries
\nto unregister its upper AMT device, but it has two problems.<\/p>\n
1. amt_lookup_upper_dev() looks up an upper device in the
\n lower device’s netns only<\/p>\n
2. amt_device_event() unregisters a single upper device only<\/p>\n
If AMT device is created on a lower device in another netns,
\nremoving the lower device triggers the splat below and gets
\nstuck until all upper devices are removed. [0]<\/p>\n
The cross-netns setup seems unintentional considering 1. and
\nthe following points:<\/p>\n
* amt_link_setup() sets dev->netns_immutable to true
\n * skb_scrub_packet() is not called in the fast path
\n * iproute2 binary fails to find cross-netns lower device via
\n link-netns:
\n # ip -n ns1 link add amt0 link-netns ns2 type amt dev veth1
\n Cannot find device “veth1”<\/p>\n
Instead of supporting it properly and preparing for per-netns
\nnetdev unreg, let’s forbid cross-netns setup.<\/p>\n
Note that the problem 2. needs a separate fix.<\/p>\n
[0]:
\nWARNING: net\/core\/dev.c:12518 at unregister_netdevice_many_notify+0x1cce\/0x2250, CPU#48: ip\/2031
\nModules linked in:
\nCPU: 48 UID: 0 PID: 2031 Comm: ip Not tainted 7.2.0-rc5+ #27 PREEMPT(full)
\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04\/01\/2014
\nRIP: 0010:unregister_netdevice_many_notify (net\/core\/dev.c:12518)
\nCode: 89 ef e8 d5 52 ae fe e9 d0 f4 ff ff 48 8d 3d f9 3b 9c 02 48 c7 c6 c0 0b 63 84 ba ab 1f 00 00 67 48 0f b9 3a e9 65 ff ff ff 90 0b 90 eb 81 48 8d 3d f6 3b 9c 02 48 c7 c6 c0 0b 63 84 ba e2 1f
\nRSP: 0018:ffffc90004abf160 EFLAGS: 00010212
\nRAX: ffff888104d38260 RBX: ffff88800b0911b8 RCX: dffffc0000000000
\nRDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff85b9f880
\nRBP: ffffc90004abf2d0 R08: ffffffff85b9f887 R09: 1ffffffff0b73f10
\nR10: dffffc0000000000 R11: fffffbfff0b73f11 R12: ffff88800b091d08
\nR13: ffff88800b091178 R14: dffffc0000000000 R15: ffff88800b091000
\nFS: 00007f555b86c600(0000) GS:ffff8881942a0000(0000) knlGS:0000000000000000
\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\nCR2: 0000562107d489c0 CR3: 0000000109a40002 CR4: 0000000000372ef0
\nCall Trace:<\/p>\n
rtnl_dellink (net\/core\/rtnetlink.c:3632 net\/core\/rtnetlink.c:3674)
\n rtnetlink_rcv_msg (net\/core\/rtnetlink.c:7112)
\n netlink_rcv_skb (net\/netlink\/af_netlink.c:2556)
\n netlink_unicast (net\/netlink\/af_netlink.c:1319)
\n netlink_sendmsg (net\/netlink\/af_netlink.c:1900)
\n ____sys_sendmsg (net\/socket.c:775)
\n __sys_sendmsg (net\/socket.c:2738)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:63)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)
\n…
\nunregister_netdevice: waiting for veth0 to become free. Usage count = 7
\nref_tracker: netdev@ffff88800d7496d8 has 3\/3 users at
\n __netdev_adjacent_dev_insert (.\/include\/linux\/netdevice.h:4525 .\/include\/linux\/netdevice.h:4554 net\/core\/dev.c:8791)
\n __netdev_upper_dev_link (net\/core\/dev.c:8879 net\/core\/dev.c:8963)
\n netdev_upper_dev_link (net\/core\/dev.c:9009)
\n amt_newlink (drivers\/net\/amt.c:3321)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
amt: Don’t support cross-netns setup.<\/p>\n
When a lower device is unregistered, amt_device_event() tries
\nto unregister its upper AMT de<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25641","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25641","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25641"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25641"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25641"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}