In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: cls_u32: fix duplicate handle when node ID pool is exhausted<\/p>\n
gen_new_kid() falls back to returning max (htid | 0xFFF) when both
\nidr_alloc_u32() ranges are full, instead of reporting an error.
\nu32_change() trusts that value and inserts a new knode with a handle
\nthat is already live in the hash table, breaking handle uniqueness
\nwithin the table’s node ID space.<\/p>\n
The handle was never reserved in ht->handle_idr, so every later error
\npath that does idr_remove(&ht->handle_idr, handle) removes the
\nreservation of a different, live knode, which is then reused \u2014 one
\nfailed add compounds into further duplicates.<\/p>\n
The 4095 limit is per (table, bucket) \u2014 ht->handle_idr is per hash
\ntable and the range is derived from htid (bucketid), so a table with
\ndivisor 256 can legitimately hold 256*4095 knodes.<\/p>\n
The sibling helper gen_new_htid() has the same silent in-band failure:
\nit returns 0 when the tp_c handle pool (1..0x7FF) is full, and
\nu32_init() publishes the root hash table with handle 0 without
\nchecking. Two root tables with handle 0 alias in u32_lookup_ht(),
\nallowing cross-tcf_proto knode add\/lookup\/delete. Add the same
\nexhaustion check that the divisor path already has.<\/p>\n
Return an error so u32_change() fails with ENOSPC\/ENOMEM when the
\nnode ID space is exhausted, and so u32_init() fails with -ENOMEM
\nwhen the hash table ID space is exhausted. The extack message
\ndistinguishes pool exhaustion (-ENOSPC) from a transient allocation
\nfailure (-ENOMEM).<\/p>\n
Conditions to recreate the bug:
\n– CONFIG_NET_SCHED=y, CONFIG_CLS_U32=y (or =m with module loaded)
\n– Create a clsact qdisc on a device, then add 4095 u32 filters with
\n auto-generated handles to fill the node ID space for the root hash
\n table (single bucket). The 4096th auto-handle filter add triggers
\n the duplicate handle (fh 800::fff reused). Reachable at Level 2
\n (unshare -Urn, namespace-local CAP_NET_ADMIN).
\n– For gen_new_htid: create 2047 u32 proto entries on the same block
\n to fill the tp_c handle pool, then create one more. The root table
\n gets handle 0 and aliases with other handle-0 root tables.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: cls_u32: fix duplicate handle when node ID pool is exhausted<\/p>\n
gen_new_kid() falls back to returning max (htid | 0xFFF) w<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29258","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}