In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: serialize udp bearer replicast list updates<\/p>\n
tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with
\nlist_add_rcu() \/ list_del_rcu(), but nothing serializes them. The add runs
\nfrom the encap receive softirq (via tipc_udp_rcast_disc()) without
\nrtnl_lock(), so it can race the cleanup delete and corrupt the list:<\/p>\n
list_del corruption. prev->next should be ffff8880298d7ab8,
\n but was ffff88802449ad38. (prev=ffff888027e3ec98)
\n kernel BUG at lib\/list_debug.c:62!
\n RIP: __list_del_entry_valid_or_report+0x17a\/0x200
\n Workqueue: events cleanup_bearer
\n Call Trace:
\n cleanup_bearer (net\/tipc\/udp_media.c:811)
\n process_one_work (kernel\/workqueue.c:3302)
\n worker_thread (kernel\/workqueue.c:3466)<\/p>\n
The bearer can be enabled from an unprivileged user namespace, as the
\nTIPCv2 generic-netlink ops carry no GENL_ADMIN_PERM.<\/p>\n
Add a spinlock to struct udp_bearer and take it around the list_add_rcu()
\nin tipc_udp_rcast_add() and the list_del_rcu() loop in cleanup_bearer() so
\nthe two writers can no longer corrupt the list.<\/p>\n
Reject a duplicate peer under the same lock before allocating, and remove
\ntipc_udp_is_known_peer(). The old lockless pre-check in
\ntipc_udp_rcast_disc() was racy: two softirqs discovering the same peer
\ncould both find it absent and add it twice.<\/p>\n
cleanup_bearer() runs from a workqueue after tipc_udp_disable() clears the
\nbearer’s up bit, so an encap softirq can still reach tipc_udp_rcast_add()
\nand add a peer after cleanup_bearer() has already emptied the list, leaking
\nthat entry when the bearer is freed. Mark the bearer disabled under
\nrcast_lock once the list is emptied and refuse further additions.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: serialize udp bearer replicast list updates<\/p>\n
tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with
\nlist_a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5425","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5425","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5425"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5425"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5425"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}