In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_log: unregister loggers before per-net teardown<\/p>\n
nf_log_syslog and nfnetlink_log unregister their per-network namespace
\noperations before unregistering their global logger backends. This
\nleaves a window where a sysctl or netlink writer can rebind the still-
\nregistered logger after the per-net pre-exit callback cleared the old
\nselection.<\/p>\n
The race looks like this:<\/p>\n
CPU 0 CPU 1
\n —- —-
\n unregister_pernet_subsys()
\n nf_log_unset(net, logger)
\n net->nf.nf_loggers[pf] = NULL<\/p>\n
lock nf_log_mutex
\n find logger in loggers[][]
\n net->nf.nf_loggers[pf] = logger
\n unlock nf_log_mutex<\/p>\n
nf_log_unregister(logger)
\n lock nf_log_mutex
\n loggers[pf][type] = NULL
\n unlock nf_log_mutex
\n synchronize_rcu()
\n module exit returns
\n module core frees backend memory<\/p>\n
Later, a sysctl read or packet logging operation can dereference the
\nstale per-net logger pointer.<\/p>\n
Fix this by unregistering the global logger backends before tearing down
\nper-net state. Once the global registrations are gone, later writers can
\nno longer rebind the logger. unregister_pernet_subsys() already waits
\nfor an RCU grace period after the pre-exit callback clears the per-net
\nselection, while nf_log_unregister() continues to cover readers of the
\nglobal logger table.<\/p>\n
Apply this ordering fix to both nf_log backends that combine per-net
\nteardown with global logger registration.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netfilter: nf_log: unregister loggers before per-net teardown<\/p>\n
nf_log_syslog and nfnetlink_log unregister their per-network namespa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29040","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29040","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29040"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29040"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29040"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}