In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: serialize qdisc_rtab_list against concurrent get\/put<\/p>\n
qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly
\nlinked list qdisc_rtab_list and a plain non-atomic ‘int refcnt’ with no
\nlock. This was only safe because every caller historically held the RTNL
\nmutex, which serialized all rate-table lookups, inserts and frees.<\/p>\n
That invariant no longer holds. cls_flower sets
\nTCF_PROTO_OPS_DOIT_UNLOCKED, so tc_new_tfilter() keeps rtnl_held == false
\nfor it and sets TCA_ACT_FLAGS_NO_RTNL. That flag propagates through
\ntcf_exts_validate_ex() -> tcf_action_init() -> tcf_action_init_1() ->
\ntcf_police_init(), which calls qdisc_get_rtab()\/qdisc_put_rtab() with the
\nRTNL mutex NOT held. Two RTM_NEWTFILTER requests on different CPUs, each
\nadding a flower filter with a police action carrying the same rate, then
\nrace on qdisc_rtab_list and on the non-atomic refcnt, leading to a
\nuse-after-free \/ double-free of the kmalloc-2k struct qdisc_rate_table.
\nqdisc_rtab_list is a single global (not per-netns), so the corrupted
\nobject is shared system-wide.<\/p>\n
BUG: KASAN: slab-use-after-free in qdisc_put_rtab+0x12f\/0x160
\n qdisc_put_rtab+0x12f\/0x160
\n tcf_police_init+0xda9\/0x1590
\n tcf_action_init_1+0x460\/0x6b0
\n tcf_action_init+0x439\/0xa40
\n tcf_exts_validate_ex+0x42d\/0x550
\n fl_change+0xddd\/0x7da0
\n tc_new_tfilter+0xaa7\/0x2420
\n rtnetlink_rcv_msg+0x95e\/0xe90
\n which belongs to the cache kmalloc-2k of size 2048<\/p>\n
Protect qdisc_rtab_list and the refcount with a dedicated spinlock. The
\n(sleeping, GFP_KERNEL) allocation in qdisc_get_rtab() is performed before
\ntaking the lock; if a concurrent inserter added an identical table in the
\nmeantime the freshly allocated one is freed under the lock, so no
\nduplicate is leaked. qdisc_put_rtab() now decrements the refcount and
\nunlinks under the same lock.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: serialize qdisc_rtab_list against concurrent get\/put<\/p>\n
qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global si<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5346","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}