In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
reboot: fix cad_pid use-after-free race<\/p>\n
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
\nreads it and passes it to pid_vnr() without protecting the lifetime of
\nthe referenced struct pid. A concurrent writer can replace cad_pid and
\ndrop the final reference to the old struct pid after the reader has
\nloaded the pointer but before pid_vnr() has finished dereferencing it,
\ncausing a use-after-free.<\/p>\n
kill_cad_pid() has the same lifetime race when it passes cad_pid to
\nkill_pid().<\/p>\n
At the time this issue was reported, an unprivileged user could reach the
\nsysctl through user and PID namespaces because cad_pid was registered in
\npid_table[]. Moving cad_pid back to the global reboot sysctl table
\ncorrected that namespace and permission mismatch, but did not fix the
\nunderlying lifetime race.<\/p>\n
Fix this by treating cad_pid as an RCU-protected pointer at both read
\nsites and by waiting for a grace period before dropping the old reference
\non the write side.<\/p>\n
call_rcu(&old_pid->rcu, …) cannot be used here because free_pid()
\nalso queues pid->rcu; queueing the same rcu_head twice can corrupt the
\nRCU callback list.<\/p>\n
Original KASAN crash stack:
\n kernel\/pid.c:545 pid_nr_ns() # reads freed pid->level
\n kernel\/pid.c:556 pid_vnr() # calls pid_nr_ns()
\n kernel\/pid.c:775 proc_do_cad_pid() # calls pid_vnr(cad_pid)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
reboot: fix cad_pid use-after-free race<\/p>\n
cad_pid is a single kernel-wide struct pid pointer. proc_do_cad_pid()
\nreads it and passes <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29094","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29094"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29094"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}