In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()<\/p>\n
vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and every
\nMDBE_ATTR_SRC_LIST member, accepts the all-zeros address.<\/p>\n
A source list is only accepted on a (*, G) entry, whose source is the
\nall-zeros address, and for each member of the list an (S, G) entry is
\nderived from it by substituting the source. Entries are keyed by a plain
\nmemcmp() of struct vxlan_mdb_entry_key, so if MDBE_ATTR_SOURCE is present
\nand holds the all-zeros address and the source list holds it as well, the
\nderived (S, G) key is byte-identical to the (*, G) key and resolves to the
\nsame entry. Omitting MDBE_ATTR_SOURCE is not equivalent, as the key is
\nthen left with a zero address family.<\/p>\n
vxlan_mdb_remote_src_del() removes the forwarding entry of a source before
\nfreeing the source entry:<\/p>\n
\tvxlan_mdb_remote_src_fwd_del(vxlan, group, remote, &ent->addr);
\n\tvxlan_mdb_remote_src_entry_del(ent);<\/p>\n
With the keys aliased, the first call deletes the remote of the entry that
\nowns ‘ent’ instead of a separate (S, G) entry, and frees ‘ent’. The second
\ncall then runs on the freed entry, and its hlist_del() reads ->pprev and
\n->next out of it and writes through them.<\/p>\n
Adding the (*, G) entry with NLM_F_REPLACE and no source list marks the
\nall-zeros source for deletion and reaches this from the sweep at the end
\nof vxlan_mdb_remote_srcs_replace().<\/p>\n
BUG: KASAN: slab-use-after-free in __vxlan_mdb_add+0x1cd\/0xd70
\n Read of size 8 at addr ffff888102852500 by task poc\/84
\n __vxlan_mdb_add+0x1cd\/0xd70
\n vxlan_mdb_add+0xc0\/0x140
\n rtnl_mdb_add+0x157\/0x2a0
\n rtnetlink_rcv_msg+0x207\/0x5a0
\n Allocated by task 84:
\n __kmalloc_cache_noprof+0x153\/0x360
\n vxlan_mdb_remote_srcs_add+0x2eb\/0x440
\n __vxlan_mdb_add+0x803\/0xd70
\n Freed by task 84:
\n kfree+0x14c\/0x3b0
\n vxlan_mdb_remote_del+0x129\/0x1a0
\n __vxlan_mdb_del+0x4f\/0xe0
\n vxlan_mdb_remote_src_fwd_del.isra.0+0x162\/0x1b0
\n __vxlan_mdb_add+0x1c5\/0xd70<\/p>\n
The MDB operations are netns-scoped, so an unprivileged user can perform
\nthem in a new user and network namespace.<\/p>\n
Reject the all-zeros address in vxlan_mdb_is_valid_source(), which covers
\nboth call sites. A (*, G) entry is expressed by omitting the source, so
\nnothing legitimate is refused.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()<\/p>\n
vxlan_mdb_is_valid_source(), which validates MDBE_ATTR_SOURCE and eve<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29276","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29276"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29276"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}