In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: track a single source interface for ANYDEV timeout\/throttle ops<\/p>\n
An ANYDEV rx op (ifindex == 0) with an active RX timeout and\/or
\nthrottle timer has no defined semantics when matching frames arrive
\nfrom several interfaces: bcm_rx_handler() can run concurrently for
\nthe same op on different CPUs, racing hrtimer_cancel()\/
\nbcm_rx_starttimer() against bcm_rx_timeout_handler() and causing
\nspurious RX_TIMEOUT notifications and last_frames corruption. The
\nsame concurrency lets throttled multiplex frames from different
\ninterfaces clobber the single rx_ifindex\/rx_stamp fields shared by
\nthe op.<\/p>\n
Add op->if_detected to track the first interface that delivers a
\nmatching frame while a timeout\/throttle timer is configured, and
\nreject frames from any other interface for that op. The claim is
\ndecided in bcm_rx_handler() before hrtimer_cancel() touches
\nop->timer, so a rejected frame can never disturb the claimed
\ninterface’s watchdog. RTR-mode ops are excluded via RX_RTR_FRAME,
\nindependent of kt_ival1\/kt_ival2, since those may briefly hold a
\nstale value from an earlier non-RTR configuration.<\/p>\n
The claim is released in bcm_notify() on NETDEV_UNREGISTER and in
\nbcm_rx_setup() when SETTIMER reconfigures the timer values.<\/p>\n
A (re-)claim is only possible on CAN devices in NETREG_REGISTERED
\ndev->reg_state to cover the release in bcm_notify() where reg_state
\nbecomes NETREG_UNREGISTERING until synchronize_net().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: track a single source interface for ANYDEV timeout\/throttle ops<\/p>\n
An ANYDEV rx op (ifindex == 0) with an active RX timeout<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6783","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}