In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: cfg80211: cancel sched scan results work on unregister<\/p>\n
cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from a
\ndriver result notification while a scheduled scan request is present. The
\nwork callback recovers the containing cfg80211_registered_device and then
\nlocks the wiphy and walks the scheduled-scan request list.<\/p>\n
wiphy_unregister() already makes the wiphy unreachable and drains rdev work
\nitems before cfg80211_dev_free() can release the object, but it does not
\ndrain sched_scan_res_wk. A queued or running result work item can therefore
\ncross the unregister\/free boundary and access freed rdev state.<\/p>\n
The buggy scenario involves two paths, with each column showing the order
\nwithin that path:<\/p>\n
scheduled-scan result path: unregister\/free path:
\n1. cfg80211_sched_scan_results() 1. interface teardown stops and
\n queues rdev->sched_scan_res_wk. removes the scheduled scan request.
\n2. cfg80211_wq starts the work 2. wiphy_unregister() drains other
\n item and recovers rdev. rdev work items.
\n3. The worker locks rdev->wiphy 3. cfg80211_dev_free() destroys and
\n and walks rdev state. frees rdev.<\/p>\n
Cancel sched_scan_res_wk in wiphy_unregister() alongside the other rdev
\nwork items. cancel_work_sync() removes a pending result notification and
\nwaits for an already running callback, so cfg80211_dev_free() cannot free
\nrdev while this work item is still active.<\/p>\n
Validation reproduced this kernel report:
\nBUG: KASAN: use-after-free in cfg80211_sched_scan_results_wk+0x4a6\/0x530
\nWorkqueue: cfg80211 cfg80211_sched_scan_results_wk [cfg80211]
\nRead of size 8
\nCall trace:
\n dump_stack_lvl+0x66\/0xa0
\n print_report+0xce\/0x630
\n cfg80211_sched_scan_results_wk+0x4a6\/0x530
\n srso_alias_return_thunk+0x5\/0xfbef5
\n __virt_addr_valid+0x224\/0x430
\n kasan_report+0xac\/0xe0
\n lockdep_hardirqs_on_prepare+0xea\/0x1a0
\n process_one_work+0x8d0\/0x18f0 (kernel\/workqueue.c:3212)
\n lock_is_held_type+0x8f\/0x100
\n worker_thread+0x5ad\/0xfd0
\n __kthread_parkme+0xc6\/0x200
\n kthread+0x31e\/0x410
\n trace_hardirqs_on+0x1a\/0x170
\n ret_from_fork+0x576\/0x810
\n __switch_to+0x57e\/0xe20
\n __switch_to_asm+0x33\/0x70
\n ret_from_fork_asm+0x1a\/0x30<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: cfg80211: cancel sched scan results work on unregister<\/p>\n
cfg80211_sched_scan_results() can queue rdev->sched_scan_res_wk from <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5467","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5467","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5467"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5467"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5467"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}