In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: fix stale rx\/tx ops after device removal<\/p>\n
RX: an RX_SETUP update(!) for an existing op skipped can_rx_register()
\nunconditionally, even when a concurrent NETDEV_UNREGISTER had already
\ntorn down its registration (op->rx_reg_dev == NULL). This silently
\ndid not re-enable frame delivery for that updated filter. bcm_rx_setup()
\nnow re-registers in that case, while leaving rx_ops with ifindex = 0
\n(all CAN devices) which never carry a tracked rx_reg_dev registered as-is.<\/p>\n
TX: bcm_notify() only handled bo->rx_ops on NETDEV_UNREGISTER, leaving
\ntx_ops with an active cyclic transmission re-arming its hrtimer
\nindefinitely to execute bcm_tx_timeout_handler(). Cancelling the hrtimer
\nprevents the runaway timer and any injection into a later reused ifindex,
\nsince nothing else calls bcm_can_tx() for the op until an explicit
\nTX_SETUP update re-arms it.<\/p>\n
Unlike bcm_rx_unreg(), which clears the tracked rx_reg_dev for rx_ops,
\nthe ifindex is intentionally left unchanged for tx_ops. bcm_tx_setup()
\nalways rejects ifindex 0, so clearing it would strand the op: neither a
\nlater TX_SETUP (bcm_find_op()) nor TX_DELETE (bcm_delete_tx_op()) could
\never find it again, since both require an exact ifindex match.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: fix stale rx\/tx ops after device removal<\/p>\n
RX: an RX_SETUP update(!) for an existing op skipped can_rx_register()
\nuncondit<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6784","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}