In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list<\/p>\n
Kijo analyzed another race in the POSIX CPU timer code:<\/p>\n
Commit bf635681c906 converted cpu_timer::firing from a tristate value to a
\nboolean. This lost the distinction between “not owned by the firing list”
\nand “still owned, but delivery was canceled”. The resulting race is:<\/p>\n
expiry handler timer_settime() timer_delete()
\n ————– ————— ————–
\n collect timer onto
\n private firing list
\n firing = true
\n observes firing = true
\n firing = false
\n return TIMER_RETRY
\n wait for handler
\n observes firing = false
\n finish deletion
\n unhash and free timer
\n resume list traversal
\n read freed elist.next
\n -> UAF<\/p>\n
The firing bit is clearly the wrong indicator since that commit.<\/p>\n
Check whether the timer is queued on the expiry list or not instead. If it
\nis queued clear the firing bit to prevent signal delivery as before and
\nreturn TIMER_RETRY so the caller unlocks the timer which allows the expiry
\ncode to make progress and remove it from the list.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list<\/p>\n
Kijo analyzed another race in the POSIX CPU timer cod<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33327","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33327","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33327"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33327"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33327"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}