In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: fs\/xattr: don’t assume the inode is locked in path_unlink\/path_rmdir<\/p>\n
bpf_lsm_has_d_inode_locked() makes the verifier rewrite
\nbpf_[set|remove]_dentry_xattr() to the _locked variants, which assume
\nthat the caller already holds the inode’s i_rwsem. The path_unlink and
\npath_rmdir hooks are listed, but security_path_unlink() and
\nsecurity_path_rmdir() run before vfs_unlink()\/vfs_rmdir() take the
\nvictim inode’s i_rwsem, so a sleepable BPF LSM program attached to
\neither hook mutates the victim’s xattrs without the lock held.<\/p>\n
Drop the two path hooks from d_inode_locked_hooks so that the verifier
\nkeeps the locking bpf_[set|remove]_dentry_xattr() variants, which take
\nthe lock themselves.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: fs\/xattr: don’t assume the inode is locked in path_unlink\/path_rmdir<\/p>\n
bpf_lsm_has_d_inode_locked() makes the verifier rewrite<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41015","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41015","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41015"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41015"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41015"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}