In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF<\/p>\n
Commit f1b4e32aca08 (“can: bcm: use call_rcu() instead of costly
\nsynchronize_rcu()”) replaced synchronize_rcu() in bcm_delete_rx_op()
\nwith call_rcu() and introduced the RX_NO_AUTOTIMER flag.<\/p>\n
However, this flag check was omitted for thrtimer in the packet rx
\nfast-path. During BCM RX operation teardown, a concurrent RCU reader
\n(bcm_rx_handler) can race and re-arm thrtimer via
\nbcm_rx_update_and_send() after call_rcu() has been scheduled. Once
\nthe RCU grace period elapses, bcm_op is freed. The subsequently
\nfiring thrtimer then dereferences the deallocated op, causing a UAF.<\/p>\n
Adding flag checks to the rx fast-path (bcm_rx_update_and_send) does not
\nfully close the TOCTOU race and introduces latency for every CAN frame.
\nConversely, calling hrtimer_cancel() directly inside the RCU callback
\n(softirq context) is fatal as hrtimer_cancel() can sleep, triggering
\na “scheduling while atomic” panic.<\/p>\n
Resolve this by deferring the timer cancellation and memory free to a
\ndedicated unbound workqueue (bcm_wq). The RCU callback now queues a
\nwork item to bcm_wq, which safely cancels both timers and deallocates
\nmemory in sleepable process context. A dedicated workqueue is used to
\nprevent system-wide WQ saturation and is cleanly flushed\/destroyed
\non module unload to avoid rmmod page faults.<\/p>\n
Since the deferred work can now outlive the calling context by an
\nunbounded amount, also take a reference on op->sk when it is assigned
\nand drop it only once the deferred work has cancelled both timers, so a
\nsocket can no longer be freed out from under a still-armed timer whose
\ncallback (bcm_send_to_user()) dereferences op->sk.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF<\/p>\n
Commit f1b4e32aca08 (“can: bcm: use call_rcu() instead of cost<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6789","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6789","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6789"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6789"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6789"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}