In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
locking\/rt: Fix the incorrect RCU protection in rt_spin_unlock()<\/p>\n
rt_spin_unlock() releases the RCU protection before unlocking the
\nlock. That opens the door for the following UAF scenario:<\/p>\n
T1\t\t\t\t\tT2
\n spin_lock(&p->lock);\t\trcu_read_lock();
\n invalidate(p);\t\t\tp = rcu_dereference(ptr);
\n rcu_assign_pointer(ptr, NULL);\tif (!p) return;
\n spin_unlock(&p->lock);\t\tspin_lock(&p->lock)
\n \t\t\t\t lock(&lock->lock);
\n\t\t\t\t rcu_read_lock();
\n kfree_rcu(p);\t\t\trcu_read_unlock();
\n\t\t\t\t….
\n\t\t\t\tspin_unlock(&p->lock)
\n\t\t\t\t rcu_read_unlock(); \/\/ Ends grace period
\n rcu_do_batch()
\n kfree(p);
\n\t\t\t UAF ->\t rt_mutex_cmpxchg_release(&lock->lock…)<\/p>\n
Regular spinlocks keep preemption disabled accross the unlock operation,
\nwhich provides full RCU protection, but the RT substitution fails to
\nresemble that. Same applies for the rwlock substitution.<\/p>\n
Move the rcu_read_unlock() invocation past the unlock operations to match
\nthe non-RT semantics. This makes it asymmetric vs. rt_xxx_lock(), but
\nthat’s harmless as the caller needs to hold RCU read lock across the lock
\noperation. The migrate_enable() call stays before the unlock operation
\nbecause there is no per CPU operation in the unlock path which would
\nrequire migration to be kept disabled.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
locking\/rt: Fix the incorrect RCU protection in rt_spin_unlock()<\/p>\n
rt_spin_unlock() releases the RCU protection before unlocking the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6758","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6758","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6758"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6758"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6758"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}