In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: isotp: use unconditional synchronize_rcu() in isotp_release()<\/p>\n
isotp_notify() unregisters the (RCU) CAN filters via can_rx_unregister()
\nand clears so->bound without waiting for a grace period. isotp_release()
\nuses so->bound to decide whether it needs to call synchronize_rcu()
\nbefore cancelling so->rxtimer, so when NETDEV_UNREGISTER runs first it
\nskips that synchronize_rcu() and can cancel the timer while an
\nin-flight isotp_rcv() is still executing and about to re-arm it via
\nisotp_send_fc(), leading to a use-after-free timer callback on the
\nfreed socket.<\/p>\n
sakisho-bot remarked a problem with rtnl_lock held in isotp_notify(),
\ntherefore make isotp_release() always call synchronize_rcu() before
\ncancelling the timers, regardless of so->bound. This still closes the
\noriginal race (isotp_notify() clearing so->bound without waiting for
\nin-flight isotp_rcv() callers before isotp_release() cancels the RX
\ntimer) without adding any RCU wait to the netdevice notifier path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: isotp: use unconditional synchronize_rcu() in isotp_release()<\/p>\n
isotp_notify() unregisters the (RCU) CAN filters via can_rx_unr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6792","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6792","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6792"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6792"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6792"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}