In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix UAF in sock clone early bailouts<\/p>\n
Similar to recent commit 9b51a6155d14 (“bpf,fork: wipe ->bpf_storage
\nbefore bailouts that access it”), sk_clone() performs an initial
\nshallow copy of the socket field ->sk_bpf_storage via sock_copy()
\nfor the cloned socket newsk.<\/p>\n
If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior
\nto calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points
\nto the parent socket’s BPF local storage. When newsk is subsequently
\nfreed via sk_free(), the deallocation path (__sk_destruct() ->
\nbpf_sk_storage_free()) destroys the parent socket’s BPF local storage,
\nleading to a use-after-free (UAF) on the parent socket.<\/p>\n
Fix this by resetting newsk->sk_bpf_storage to NULL immediately after
\nsock_copy() in sk_clone(), and remove the now redundant initialization
\nfrom bpf_sk_storage_clone().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Fix UAF in sock clone early bailouts<\/p>\n
Similar to recent commit 9b51a6155d14 (“bpf,fork: wipe ->bpf_storage
\nbefore bailouts tha<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5461","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5461","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5461"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5461"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5461"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}