In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
batman-adv: bla: avoid CRC corruption due to parallel claim add<\/p>\n
batadv_bla_add_claim() is used to add claims and modify the backbone of
\nclaims for CLAIM frames from remote backbones and local packets. When it
\nhandles a claim, it needs to either<\/p>\n
* add the new claim’s CRC to the backbone CRC
\n* remove the already existing claim’s CRC from the old backbone and add it
\n to the new backbone<\/p>\n
But when the “new” claim code was running in parallel to the “change
\nbackbone” code, it can happen that the CRC was invalid because the
\nbackbone_gw of the claim was changed twice in the “new” claim code path:<\/p>\n
* CPU0 creates the claim for gateway A and publishes it in the claim
\n hash. The crc16 of the address has not yet been added to A’s crc at
\n this point.<\/p>\n
* CPU1 processes a claim frame of gateway B for the same client, finds
\n the just published claim, and performs the ownership change: it
\n switches the pointer to B, removes the crc16 from A’s crc – which
\n never contained it – and adds it to B’s crc.<\/p>\n
* CPU0 continues behind the creation branch, unconditionally switches
\n the pointer back to A without compensating B’s crc (its remove_crc
\n is false for the creation path), and finally adds the crc16 to A’s
\n crc<\/p>\n
The CRC is then wrong for both:<\/p>\n
* claim belongs to A: but CRC is not part of backbone A’s CRC
\n* claim doesn’t belong to B: CRC is still part of backbone B’s CRC<\/p>\n
This wrong CRC is never recomputated from the stored claims. For local
\nbackbone claims, this can also not recovered using syncs.<\/p>\n
To avoid this, split the functionality in clear separate parts:<\/p>\n
* new claim which always adds claim CRC to the backbone CRC (but never
\n changes the already set backbone_gw of the claim back)<\/p>\n
* update of existing claim which automatically changes the backbone_gw
\n entry and only updates both backbone CRCs when there was an actual change<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
batman-adv: bla: avoid CRC corruption due to parallel claim add<\/p>\n
batadv_bla_add_claim() is used to add claims and modify the backbo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26060","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}