In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: act_tunnel_key: Defer dst_release to RCU callback<\/p>\n
Fix a race-condition use-after-free in tunnel_key_release_params().<\/p>\n
The function releases the metadata_dst of the old params synchronously
\nvia dst_release() while deferring the params struct free with
\nkfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may
\nstill hold the old params pointer (under rcu_read_lock_bh) and proceed
\nto call dst_clone(¶ms->tcft_enc_metadata->dst) after the writer’s
\ndst_release has already pushed the dst’s rcuref to RCUREF_DEAD.<\/p>\n
zdi-disclosures@trendmicro.com produced a poc which i (and Victor) verified
\nthat KASAN reports:<\/p>\n
==================================================================
\nBUG: KASAN: slab-use-after-free in instrument_atomic_read_write include\/linux\/instrumented.h:112
\nBUG: KASAN: slab-use-after-free in atomic_sub_return_release include\/linux\/atomic\/atomic-instrumented.h:326
\nBUG: KASAN: slab-use-after-free in __rcuref_put include\/linux\/rcuref.h:109
\nBUG: KASAN: slab-use-after-free in rcuref_put include\/linux\/rcuref.h:173
\nBUG: KASAN: slab-use-after-free in dst_release+0x5b\/0x370 net\/core\/dst.c:168
\nWrite of size 4 at addr ffff88806158de40 by task poc\/9388<\/p>\n
CPU: 0 UID: 0 PID: 9388 Comm: poc Tainted: G W 7.1.0-rc7 #7 PREEMPT(lazy)
\nTainted: [W]=WARN
\nHardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04\/01\/2014
\nCall Trace:<\/p>\n
__dump_stack lib\/dump_stack.c:94
\n dump_stack_lvl+0x100\/0x190 lib\/dump_stack.c:120
\n print_address_description mm\/kasan\/report.c:378
\n print_report+0x139\/0x4ad mm\/kasan\/report.c:482
\n kasan_report+0xe4\/0x1d0 mm\/kasan\/report.c:595
\n check_region_inline mm\/kasan\/generic.c:186
\n kasan_check_range+0x125\/0x200 mm\/kasan\/generic.c:200
\n instrument_atomic_read_write include\/linux\/instrumented.h:112
\n atomic_sub_return_release include\/linux\/atomic\/atomic-instrumented.h:326
\n __rcuref_put include\/linux\/rcuref.h:109
\n rcuref_put include\/linux\/rcuref.h:173
\n dst_release+0x5b\/0x370 net\/core\/dst.c:168
\n refdst_drop include\/net\/dst.h:272
\n skb_dst_drop include\/net\/dst.h:284
\n skb_release_head_state+0x293\/0x400 net\/core\/skbuff.c:1163
\n skb_release_all net\/core\/skbuff.c:1187
\n[..]
\nAllocated by task 9391:
\n kasan_save_stack+0x30\/0x50 mm\/kasan\/common.c:57
\n kasan_save_track+0x14\/0x30 mm\/kasan\/common.c:78
\n poison_kmalloc_redzone mm\/kasan\/common.c:398
\n __kasan_kmalloc+0x9a\/0xb0 mm\/kasan\/common.c:415
\n kasan_kmalloc include\/linux\/kasan.h:263
\n __do_kmalloc_node mm\/slub.c:5296
\n __kmalloc_noprof+0x2f1\/0x830 mm\/slub.c:5308
\n kmalloc_noprof include\/linux\/slab.h:954
\n kzalloc_noprof include\/linux\/slab.h:1188
\n offload_action_alloc+0x2f\/0x130 net\/core\/flow_offload.c:35
\n tcf_action_offload_add_ex+0x1ba\/0x880 net\/sched\/act_api.c:258
\n tcf_action_offload_add net\/sched\/act_api.c:293
\n tcf_action_init+0x66e\/0xa20 net\/sched\/act_api.c:1547
\n tcf_action_add+0xf6\/0x5d0 net\/sched\/act_api.c:2101
\n[..]
\nFreed by task 9391:
\n kasan_save_stack+0x30\/0x50 mm\/kasan\/common.c:57
\n kasan_save_track+0x14\/0x30 mm\/kasan\/common.c:78
\n kasan_save_free_info+0x3b\/0x70 mm\/kasan\/generic.c:584
\n poison_slab_object mm\/kasan\/common.c:253
\n __kasan_slab_free+0x6b\/0x90 mm\/kasan\/common.c:285
\n kasan_slab_free include\/linux\/kasan.h:235
\n slab_free_hook mm\/slub.c:2689
\n slab_free mm\/slub.c:6251
\n kfree+0x21f\/0x6b0 mm\/slub.c:6566
\n tcf_action_offload_add_ex+0x4ad\/0x880 net\/sched\/act_api.c:284
\n tcf_action_offload_add net\/sched\/act_api.c:293
\n tcf_action_init+0x66e\/0xa20 net\/sched\/act_api.c:1547
\n tcf_action_add+0xf6\/0x5d0 net\/sched\/act_api.c:2101<\/p>\n
The buggy address belongs to the object at ffff88806158de00
\n which belongs to the cache kmalloc-256 of size 256
\nThe buggy address is located 64 bytes inside of
\n freed 256-byte region [ffff88806158de00, ffff88806158df00)<\/p>\n
The buggy address belongs to the physical page:
\npage: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88806158d600 pfn:0x6158c
\nhead: order:1 mapcount:0 entire_map
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: act_tunnel_key: Defer dst_release to RCU callback<\/p>\n
Fix a race-condition use-after-free in tunnel_key_release_params().<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5443","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5443","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5443"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5443"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5443"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}