In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ieee802154: hwsim: serialize pib updates to fix double-free<\/p>\n
hwsim_update_pib() does an unserialized read-swap-free of phy->pib:<\/p>\n
\tpib_old = rtnl_dereference(phy->pib);
\n\t…
\n\trcu_assign_pointer(phy->pib, pib);
\n\tkfree_rcu(pib_old, rcu);<\/p>\n
It assumes the RTNL is held, but ->set_channel is not always called
\nunder it: the mac802154 scan worker changes channels via
\ndrv_set_channel() without the RTNL. Such an update can race an
\nRTNL-held one on the same phy; both read the same pib_old and both
\nkfree_rcu() it, double-freeing the object. With SLUB percpu sheaves
\nbatching kfree_rcu(), this surfaces as a KASAN invalid-free in
\nrcu_free_sheaf().<\/p>\n
struct hwsim_phy has no lock for pib. Add one and make the swap atomic
\nwith rcu_replace_pointer() under it, dropping the misleading
\nrtnl_dereference().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ieee802154: hwsim: serialize pib updates to fix double-free<\/p>\n
hwsim_update_pib() does an unserialized read-swap-free of phy->pib:<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29031","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29031","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29031"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29031"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29031"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}