In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: pin upper rpc_clnt across the TLS connect_worker<\/p>\n
The TLS connect path has a use-after-free: nothing pins the
\nupper rpc_clnt across the delayed connect_worker. xs_connect()
\nstores task->tk_client in sock_xprt::clnt as a raw pointer
\nand queues the worker; for TLS-secured transports that worker
\nis xs_tcp_tls_setup_socket(), which reads several fields out
\nof the saved pointer (cl_timeout, cl_program, cl_prog,
\ncl_vers, cl_cred, cl_stats) to construct the args for the
\ninner handshake rpc_clnt.<\/p>\n
The xprt does not reference the rpc_clnt; the rpc_clnt
\nreferences the xprt. xs_destroy() does cancel the
\nconnect_worker, but it runs only when the xprt’s refcount
\ndrops to zero, which cannot happen until the rpc_clnt
\nreleases its cl_xprt reference in rpc_free_client_work().
\nWhen a TLS handshake fails fatally (for example, an mTLS
\nmount whose client cert does not match the server), the
\nconnecting task is woken with -EACCES and exits, the mount
\ncaller invokes rpc_shutdown_client(), and the upper rpc_clnt
\nis freed before the queued connect_worker fires.
\nxs_tcp_tls_setup_socket() then dereferences the freed clnt,
\nproducing the refcount_t underflow Michael Nemanov reported.<\/p>\n
Take a reference on the upper rpc_clnt in xs_connect() for
\nTLS transports via a new rpc_hold_client() helper, and drop
\nit in the connect_worker’s exit path with rpc_release_client().
\nThe xprt_lock_connect() \/ xprt_unlock_connect() pairing
\nalready serialises xs_connect() with xs_tcp_tls_setup_socket(),
\nso the take and release are balanced one-for-one.<\/p>\n
The non-TLS connect worker (xs_tcp_setup_socket) never reads
\nsock_xprt::clnt, so leave that path alone and avoid the
\nclnt-holds-xprt-holds-clnt cycle that would otherwise prevent
\nxprt destruction.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: pin upper rpc_clnt across the TLS connect_worker<\/p>\n
The TLS connect path has a use-after-free: nothing pins the
\nupper rpc_cln<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6941","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6941","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}