In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: defer md5sig_info kfree past RCU grace period in tcp_connect<\/p>\n
The md5+ao reconciliation in tcp_connect() (net\/ipv4\/tcp_output.c)
\nhas two symmetric branches:<\/p>\n
\tif (needs_md5) {
\n\t\ttcp_ao_destroy_sock(sk, false);
\n\t} else if (needs_ao) {
\n\t\ttcp_clear_md5_list(sk);
\n\t\tkfree(rcu_replace_pointer(tp->md5sig_info, NULL, …));
\n\t}<\/p>\n
Both branches free a per-socket auth-info object while the socket is
\nin TCP_SYN_SENT and is already on the inet ehash (inserted by
\ninet_hash_connect() in tcp_v4_connect()). Both branches are reachable
\nby softirq RX-path readers that load the corresponding info pointer
\nvia implicit RCU before bh_lock_sock_nested() is taken.<\/p>\n
The needs_md5 branch is fixed in the prior patch by re-introducing
\nthe call_rcu() free in tcp_ao_destroy_sock(): the equivalent per-key
\nloop runs inside tcp_ao_info_free_rcu(), the RCU callback, so by the
\ntime it frees each tcp_ao_key all softirq readers that captured the
\ncontainer have already completed rcu_read_unlock().<\/p>\n
The needs_ao branch is not symmetric in the same way. The container
\nfree can be deferred via kfree_rcu(md5sig, rcu) — struct
\ntcp_md5sig_info already has the required rcu member
\n(include\/net\/tcp.h:1999-2002), and the rest of the tree already does
\nthis in the tcp_md5sig_info_add() rollback paths
\n(net\/ipv4\/tcp_ipv4.c:1410, 1436). But the per-key teardown is done
\nby tcp_clear_md5_list() in process context BEFORE the container’s
\nRCU grace period: it walks &md5sig->head and frees each
\ntcp_md5sig_key with bare hlist_del + kfree. A concurrent softirq
\nreader in __tcp_md5_do_lookup() \/ __tcp_md5_do_lookup_exact()
\n(tcp_ipv4.c:1253, 1298) walks the same list via
\nhlist_for_each_entry_rcu() and races with that bare kfree on the
\nkeys themselves — a per-key slab use-after-free of the same class
\nas the TCP-AO bug, on the same race window.<\/p>\n
Fix this in two halves:<\/p>\n
1. Convert the bare kfree() in tcp_connect() to kfree_rcu() so the
\n md5sig_info container joins the rest of the md5sig lifecycle.
\n The local-variable lift is mechanical and required because
\n kfree_rcu() is a macro that expects an lvalue.<\/p>\n
2. Make tcp_clear_md5_list() RCU-safe by replacing hlist_del +
\n kfree(key) with hlist_del_rcu + kfree_rcu(key, rcu). struct
\n tcp_md5sig_key already carries the rcu member
\n (include\/net\/tcp.h:1995) and tcp_md5_do_del()
\n (net\/ipv4\/tcp_ipv4.c:1456) already uses kfree_rcu, so this
\n restores the lifecycle invariant the rest of the file follows
\n rather than introducing a one-off.<\/p>\n
The other caller of tcp_clear_md5_list() is tcp_md5_destruct_sock()
\n(net\/ipv4\/tcp.c:412), which runs from the sock destructor when the
\nsocket is already unhashed and unreachable; the extra grace period
\nthere is unnecessary but harmless. Making the helper unconditionally
\nRCU-safe is the cleaner contract.<\/p>\n
The needs_ao branch is not reachable by the userns reproducer used
\nto demonstrate the AO-side splat (the repro installs both keys but
\nends up in the needs_md5 branch because the connect peer matches
\nthe MD5 key, not the AO key); however the symmetric race exists
\nand a maintainer touching this code should not have to think about
\nwhich branch escapes RCU and which one does not.<\/p>\n
[also credits to Qihang, who found that this races with tcp-diag]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: defer md5sig_info kfree past RCU grace period in tcp_connect<\/p>\n
The md5+ao reconciliation in tcp_connect() (net\/ipv4\/tcp_output.<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6800","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6800","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6800"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6800"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6800"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}