In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow<\/p>\n
Commit 48a5fe38772b (“tipc: fix bc_ackers underflow on duplicate
\nGRP_ACK_MSG”) rejected duplicate\/stale ACKs in tipc_group_proto_rcv()
\nby returning early when less_eq(acked, m->bc_acked).<\/p>\n
However, that check remains incomplete in two ways:<\/p>\n
1. When grp->bc_ackers is zero (e.g. on a quiet group, when replicast
\n ACKs were not requested, or after all expected members have already
\n acknowledged), an unexpected GRP_ACK_MSG with acked > m->bc_acked
\n passes less_eq() and unconditionally decrements grp->bc_ackers.
\n Because bc_ackers is a u16, this wraps to 65535, causing
\n tipc_group_bc_cong() to permanently report congestion and blocking
\n all future group broadcasts on the socket.<\/p>\n
2. During an active broadcast round (grp->bc_ackers > 0), the sender
\n transmits packet S and advances grp->bc_snd_nxt to S + 1. Receivers
\n increment their expected counter to S + 1 upon consuming packet S,
\n so the only valid ACK value for the current round is strictly
\n acked == grp->bc_snd_nxt.<\/p>\n
However, tipc_group_update_bc_members() initializes each member’s
\n m->bc_acked to prev = grp->bc_snd_nxt – 1 (S – 1 before increment).
\n This leaves a 2-sequence gap (S – 1 to S + 1) in sequence space.
\n An incoming ACK is therefore neither rejected as duplicate nor
\n prevented from decrementing grp->bc_ackers if an unexpected or stale
\n value (such as S) is received. A member sending acked = S followed
\n by acked = S + 1 could decrement grp->bc_ackers twice in the same
\n round, prematurely clearing bc_ackers or underflowing it.<\/p>\n
Fix this by:
\n– Dropping GRP_ACK_MSG immediately if grp->bc_ackers is zero.
\n– Requiring acked == grp->bc_snd_nxt and rejecting duplicates where
\n m->bc_acked == acked. Because replicast broadcast rounds are strictly
\n sequential, only grp->bc_snd_nxt can be acknowledged, and each member
\n can acknowledge at most once per round.<\/p>\n
Note that a related pre-existing issue in tipc_group_delete_member()
\n(where grp->bc_ackers decrementing to zero upon member departure does
\nnot restore *grp->open or trigger a socket wakeup) will be addressed
\nin a separate patch.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow<\/p>\n
Commit 48a5fe38772b (“tipc: fix bc_ackers underflow<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41022","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41022","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41022"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41022"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41022"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}