In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER<\/p>\n
isotp_release() looked up the bound network device via dev_get_by_index()
\nusing the stored ifindex. During device unregistration the device is
\nunlisted from the ifindex hash before the NETDEV_UNREGISTER notifier
\nchain runs, so a concurrent isotp_release() could find no device, skip
\ncan_rx_unregister() entirely, and still proceed to free the socket.
\nSince isotp_release() had already removed itself from the isotp
\nnotifier list at that point, isotp_notify() would never get a chance to
\nclean up either, leaving a stale CAN filter that keeps pointing at the
\nfreed socket.<\/p>\n
Fix this the same way raw.c already does: hold a tracked reference to
\nthe bound net_device in the socket (so->dev\/so->dev_tracker) from
\nbind() onward instead of re-resolving it from the ifindex, and
\nserialize bind()\/release() with rtnl_lock() so that so->dev is always
\nconsistent with what the NETDEV_UNREGISTER notifier sees. so->dev
\nstays valid regardless of ifindex-hash unlisting, and is only ever
\ncleared by whichever of isotp_release()\/isotp_notify() gets there
\nfirst, so the filter is always removed exactly once.<\/p>\n
isotp_bind() now rejects a (re)bind with -EAGAIN while so->[tx|rx].state
\nisn’t ISOTP_IDLE yet, so a timer left running by a prior
\nNETDEV_UNREGISTER can’t act on a newly bound so->ifindex. Both checks
\nshare the same lock_sock() section, so there is no window in which a
\nconcurrent isotp_notify() clearing so->bound could be missed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER<\/p>\n
isotp_release() looked up the bound network device via dev_g<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6791","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6791","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6791"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6791"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6791"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}