In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: openvswitch: fix use-after-free of the flow table mask array<\/p>\n
tbl_mask_array_realloc() retires the old mask_array before it stops being
\nreachable:<\/p>\n
\told = ovsl_dereference(tbl->mask_array);
\n\tif (old) {
\n\t\t…
\n\t\tcall_rcu(&old->rcu, mask_array_rcu_cb);
\n\t}<\/p>\n
\trcu_assign_pointer(tbl->mask_array, new);<\/p>\n
call_rcu() only waits for read-side critical sections already in flight.
\ntbl->mask_array still points at old between the call_rcu() and the
\nrcu_assign_pointer(), so a reader entering ovs_flow_tbl_lookup_stats() in
\nthat window picks up old in a fresh critical section that the pending
\ngrace period does not cover.<\/p>\n
tbl_mask_array_realloc() runs in process context under ovs_mutex, so the
\nwindow is preemptible and can outlast the grace period. Then
\nmask_array_rcu_cb() frees old before the swap runs:<\/p>\n
BUG: KASAN: slab-use-after-free in flow_lookup.constprop.0+0x2bf\/0x2f0
\n Read of size 8 at addr ffff888020b3e018 by task poc\/741
\n flow_lookup.constprop.0+0x2bf\/0x2f0
\n ovs_flow_tbl_lookup_stats+0x4a3\/0x5c0
\n ovs_dp_process_packet+0x19c\/0x710
\n ovs_vport_receive+0x243\/0x390
\n internal_dev_xmit+0x81\/0x170
\n Freed by task 728:
\n kfree+0x16a\/0x4e0
\n rcu_core+0x853\/0x1030<\/p>\n
Publish the new array before retiring the old one. The kfree_rcu() that
\ncall_rcu() replaced ran after the swap.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: openvswitch: fix use-after-free of the flow table mask array<\/p>\n
tbl_mask_array_realloc() retires the old mask_array before it st<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29043","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29043","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29043"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29043"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29043"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}