In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netlink: do not free nlk->groups while lockless readers can use it<\/p>\n
netlink_realloc_groups() uses krealloc() under netlink_table_grab().
\nWhenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old
\nbitmap is freed immediately.<\/p>\n
Two readers of nlk->groups \/ nlk->ngroups do not hold the netlink
\ntable lock:<\/p>\n
1) sk_diag_dump_groups(). Hashed (bound) sockets are dumped from the
\n rhashtable walk in __netlink_diag_dump(), which only holds RCU.
\n Only the mc_list part of the dump takes nl_table_lock.<\/p>\n
2) netlink_native_seq_show() (\/proc\/net\/netlink), whose walk has been
\n lockless since commit 21e4902aea80 (“netlink: Lockless lookup with
\n RCU grace period in socket release”).<\/p>\n
Both can read a freed buffer, and sk_diag_dump_groups() can also read
\npast the end of the old (smaller) buffer if it happens to load the old
\n@groups pointer together with the new @ngroups value, copying the
\nresult into a NETLINK_DIAG_GROUPS attribute.<\/p>\n
This is the same class of bug that commit f773608026ee (“netlink:
\naccess nlk groups safely in netlink bind and getname”) fixed for bind()
\nand getname(); these two readers were missed. Simply grabbing the table
\nlock in sk_diag_dump_groups() is not an option, because it is also
\ncalled with nl_table_lock already held from the mc_list section of the
\ndump.<\/p>\n
Make the lockless readers safe instead:<\/p>\n
– Allocate a new bitmap and free the old one after an RCU grace period,
\n instead of relying on the implicit kfree() done by krealloc().<\/p>\n
– Publish @groups before @ngroups, both with release semantics, and have
\n the lockless readers load @ngroups first. A reader can then never pair
\n the new (bigger) size with the old (smaller) buffer, and a reader
\n picking up the new pointer while still seeing the old size is
\n guaranteed to see the initialized bitmap.<\/p>\n
netlink_realloc_groups() is called from process context (bind() and
\nsetsockopt()), so kfree_rcu_mightsleep() can be used, once the table
\nhas been released.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
netlink: do not free nlk->groups while lockless readers can use it<\/p>\n
netlink_realloc_groups() uses krealloc() under netlink_table_gr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33353","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33353","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33353"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33353"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33353"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}