In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: clear mode callbacks after failed mode setup<\/p>\n
xfrm_state_gc_task can run long after a failed IPTFS state setup. In the
\nreproduced case, __xfrm_init_state() cached x->mode_cbs, IPTFS setup
\nreturned -ENOMEM before publishing mode_data, and the temporary module
\nreference from xfrm_get_mode_cbs() was dropped immediately. The dead state
\nthen kept x->mode_cbs until deferred GC ran after xfrm_iptfs had been
\nunloaded.<\/p>\n
Clear x->mode_cbs when mode init or clone fails before publishing
\nmode_data. Those states never installed mode-specific state or the
\nlong-term IPTFS module pin, so deferred GC has nothing mode-specific to
\ndestroy and must not retain a callback table pointer past the temporary
\nlookup reference.<\/p>\n
The buggy scenario involves two paths, with each column showing the order
\nwithin that path:<\/p>\n
failed setup path:
\n1. cache x->mode_cbs
\n2. mode setup fails before mode_data
\n3. drop the temporary module ref
\n4. dead state keeps x->mode_cbs cached<\/p>\n
GC\/unload path:
\n1. xfrm_state_put() queues GC work
\n2. xfrm_iptfs unloads later
\n3. xfrm_state_gc_task runs
\n4. GC dereferences stale x->mode_cbs<\/p>\n
This also covers the failed clone path where clone_state() returns before
\npublishing mode_data.<\/p>\n
Validation reproduced this kernel report:
\nKernel panic – not syncing: Fatal exception
\nCONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
\nfailslab_stacktrace_filter matched xfrm_iptfs frames
\nack_error=-12
\nFAULT_INJECTION: forcing a failure
\nBUG: unable to handle page fault
\nWorkqueue: events xfrm_state_gc_task
\nRIP: xfrm_state_gc_task+0x142\/0x650
\nModules linked in: esp4_offload xfrm_user [last unloaded: xfrm_iptfs]
\nKernel panic – not syncing: Fatal exception<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: clear mode callbacks after failed mode setup<\/p>\n
xfrm_state_gc_task can run long after a failed IPTFS state setup. In the
\nreprod<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5468","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}