In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()<\/p>\n
When a socket transmits a packet with MCTP_TAG_PREALLOC set,
\nmctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list
\nand matches netid, req_tag, peer_addr, and manual_alloc, without
\nchecking whether tmp->sk == &msk->sk. This allows any MCTP socket in the
\nsame network namespace to use and consume another socket’s preallocated
\ntag.<\/p>\n
Iterate the socket’s own tag list (&msk->keys via sklist) instead of the
\nnamespace-wide &mns->keys list in mctp_lookup_prealloc_tag(), ensuring
\nthat only tags allocated by msk are matched.<\/p>\n
Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag
\n(0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a
\n4-byte message with MCTP_TAG_PREALLOC from socket B in the same network
\nnamespace. On the unfixed kernel, sendto(sock_b) using socket A’s
\npreallocated tag succeeds (ret = 4); with this patch applied,
\nsendto(sock_b) fails with -ENOENT (errno = 2) while sendto(sock_a)
\nsucceeds (ret = 4).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()<\/p>\n
When a socket transmits a packet with MCTP_TAG_PREALLOC set,
\nmc<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40997","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40997","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40997"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}