In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
afs: Clear stale peer app data after address list changes<\/p>\n
afs_fs_probe_fileserver() fetches the current endpoint state under
\nserver->fs_lock, but leaves old_alist as NULL. Consequently,
\nafs_set_peer_appdata() treats every address list replacement as initial
\nsetup and only binds the new peers; it never unbinds peers removed from
\nthe old list.<\/p>\n
An address refresh can therefore proceed as follows. CPU 0 replaces
\nserver S’s list and drops Pold without clearing Pold->app_data. The
\nserver destroyer then clears only S’s current peers and lets S reach its
\nRCU callback. After the callback frees S, CPU 1 handles a callback
\nthrough an RxRPC connection that still pins Pold, reads Pold->app_data,
\nand calls afs_use_server() on the freed object.<\/p>\n
KASAN reported:<\/p>\n
BUG: KASAN: slab-use-after-free in afs_find_server+0x3c\/0xa0
\n Read of size 4 at addr ffff8881013e1af0 by task krxrpcio\/7001\/74
\n Call Trace:
\n afs_find_server+0x3c\/0xa0
\n afs_rx_new_call+0x15c\/0x390
\n rxrpc_new_incoming_call+0x97c\/0x1730
\n rxrpc_input_packet.constprop.0+0xd03\/0xec0
\n rxrpc_io_thread+0x967\/0x1640
\n Allocated by task 93:
\n afs_lookup_server+0x1a7\/0x14c0
\n afs_alloc_server_list+0x43f\/0xb60
\n afs_create_volume+0x923\/0x1490
\n afs_get_tree+0x1c6\/0x10a0
\n Freed by task 0:
\n kfree+0x131\/0x3c0
\n rcu_core+0x50a\/0x1850
\n Last potentially related work creation:
\n __call_rcu_common.constprop.0+0x71\/0xa10
\n afs_put_server+0x213\/0x2b0<\/p>\n
Preserve old->addresses for the peer app-data update so that removed
\npeers are cleared before the endpoint state is replaced. Also advance
\nboth cursors when the old and new lists share a peer; activating the
\nold\/new comparison without this would otherwise loop forever on the
\nshared entry.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
afs: Clear stale peer app data after address list changes<\/p>\n
afs_fs_probe_fileserver() fetches the current endpoint state under
\nserve<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29015","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29015","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29015"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29015"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29015"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}