In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: add missing device refcount for CAN filter removal<\/p>\n
sashiko-bot remarked a problem with a concurrent device unregistration
\nin isotp.c which also is present in the bcm.c code. A former fix for raw.c
\ncommit c275a176e4b6 (“can: raw: add missing refcount for memory leak fix”)
\nintroduced a netdevice_tracker which solves the issue for bcm.c too.<\/p>\n
bcm_release(), bcm_delete_rx_op() and bcm_notifier() relied on
\ndev_get_by_index(ifindex) to re-find the device for an rx_op before
\nunregistering its filter. If a concurrent NETDEV_UNREGISTER has already
\nunlisted the device from the ifindex table, that lookup fails and
\ncan_rx_unregister() is silently skipped, leaving a stale CAN filter
\npointing at the soon-to-be-freed bcm_op\/socket.<\/p>\n
Hold a netdev_hold()\/netdev_put() tracked reference on op->rx_reg_dev
\nfrom the moment the rx filter is registered in bcm_rx_setup() until it
\nis unregistered in bcm_rx_unreg(), and use that reference directly in
\nbcm_release() and bcm_delete_rx_op() instead of re-looking the device
\nup by ifindex.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: add missing device refcount for CAN filter removal<\/p>\n
sashiko-bot remarked a problem with a concurrent device unregistratio<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6781","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6781","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}