In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rhashtable: clear stale iter->p on table restart<\/p>\n
rhashtable_walk_start_check() has two restart paths when resuming a walk.
\nWhen iter->walker.tbl is valid, it re-validates iter->p against the table
\nand sets iter->p = NULL if the object is gone. When iter->walker.tbl is
\nNULL (table was freed during resize), it resets slot and skip but forgets
\nto clear iter->p.<\/p>\n
rhashtable_walk_next() then dereferences the stale iter->p, reading
\nfreed memory. This is a use-after-free.<\/p>\n
Any caller that does multi-fragment rhashtable walks across
\nwalk_stop\/walk_start boundaries is affected. Concrete cases include
\nnetlink_diag (__netlink_diag_dump in net\/netlink\/diag.c) and TIPC
\n(tipc_nl_sk_walk in net\/tipc\/socket.c).<\/p>\n
Crash stack (netlink_diag):
\n BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365\/0x3c0
\n Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)
\n Call Trace:
\n rhashtable_walk_next+0x365\/0x3c0 (lib\/rhashtable.c:1016)
\n __netlink_diag_dump+0x160\/0x760 (net\/netlink\/diag.c:122)
\n netlink_diag_dump+0xc2\/0x240
\n netlink_dump+0x5bc\/0x1270
\n netlink_recvmsg+0x7a3\/0x980
\n sock_recvmsg+0x1bc\/0x200
\n __sys_recvfrom+0x1d4\/0x2c0<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rhashtable: clear stale iter->p on table restart<\/p>\n
rhashtable_walk_start_check() has two restart paths when resuming a walk.
\nWhen it<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-4485","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/4485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}