In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Skip unsettled links in link iterator<\/p>\n
bpf_link_prime() inserts a link into link_idr before anon_inode_getfile()
\nsucceeds and before bpf_link_settle() publishes the ID in link->id.
\nbpf_link_by_id() treats such an ID-zero link as unsettled, but the link
\niterator takes a reference without this check.<\/p>\n
If anon_inode_getfile() then fails, the creator removes the ID and frees
\nits still-private link directly. The iterator is left with a dangling
\nreference and its next bpf_link_put() accesses freed memory.<\/p>\n
Treat ID-zero entries as transient in bpf_link_get_curr_or_next(), just as
\nbpf_link_by_id() does.<\/p>\n
BUG: KASAN: slab-use-after-free in bpf_link_put
\n Write of size 8 by task exp\/384
\n Call Trace:
\n bpf_link_put kernel\/bpf\/syscall.c:3372
\n bpf_link_seq_next kernel\/bpf\/link_iter.c:33
\n bpf_seq_read kernel\/bpf\/bpf_iter.c:158
\n vfs_read fs\/read_write.c:572
\n ksys_read fs\/read_write.c:716
\n do_syscall_64 arch\/x86\/entry\/syscall_64.c:84
\n entry_SYSCALL_64_after_hwframe arch\/x86\/entry\/entry_64.S:121
\n Kernel panic – not syncing: KASAN: panic_on_warn set …<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Skip unsettled links in link iterator<\/p>\n
bpf_link_prime() inserts a link into link_idr before anon_inode_getfile()
\nsucceeds and <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-34941","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/34941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}