In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()<\/p>\n
TIPC UDP media bearer teardown calls dst_cache_destroy() on its
\nreplicast caches before calling synchronize_net() to wait for
\nconcurrent RCU readers (transmitters) to finish:<\/p>\n
static void cleanup_bearer(struct work_struct *work)
\n{
\n…
\n\tlist_for_each_entry_safe(rcast, tmp, &ub->rcast.list, list) {
\n\t\tdst_cache_destroy(&rcast->dst_cache);
\n\t\tlist_del_rcu(&rcast->list);
\n\t\tkfree_rcu(rcast, rcu);
\n\t}
\n…
\n\tdst_cache_destroy(&ub->rcast.dst_cache);
\n\tudp_tunnel_sock_release(ub->sk);
\n\tsynchronize_net();
\n…
\n}<\/p>\n
This is highly buggy because dst_cache_destroy() immediately frees the
\nper-CPU cache memory (free_percpu()) and releases the cached dst
\nentries without any synchronization.<\/p>\n
If a concurrent transmitter (e.g., tipc_udp_xmit()) is running on another
\nCPU under RCU protection, it can call dst_cache_get() concurrently,
\nleading to:
\n1. Use-After-Free on the per-CPU cache pointer itself (crash).
\n2. “rcuref – imbalanced put()” warning if it attempts to release a
\n dst that was concurrently released by dst_cache_destroy().<\/p>\n
Furthermore, calling kfree(ub) immediately after synchronize_net() without
\nclosing the socket first (or waiting after closing it) leaves a window
\nwhere a concurrent receiver (tipc_udp_recv()) could start after
\nsynchronize_net(), access ub, and suffer a UAF when kfree(ub) runs.<\/p>\n
To fix this, we must defer dst_cache_destroy() and kfree(ub) until after
\nwe have ensured that no more readers can see the bearer\/socket and all
\nexisting readers have finished:<\/p>\n
1. Defer rcast entry destruction (both dst_cache_destroy() and kfree())
\n to an RCU callback using call_rcu_hurry().
\n Using call_rcu_hurry() ensures the dst entries are released quickly.<\/p>\n
2. Release the bearer socket using udp_tunnel_sock_release() (stops
\n new receive readers).<\/p>\n
3. Call synchronize_net() to wait for all outstanding RCU readers
\n (both transmit and receive) to finish.<\/p>\n
4. Now that it is safe, call dst_cache_destroy() on the main bearer
\n cache, and free ub.<\/p>\n
Note: 3) and 4) can be changed later in net-next to also use
\ncall_rcu_hurry() and get rid of the synchronize_net() latency.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()<\/p>\n
TIPC UDP media bearer teardown calls dst_cache_destroy() on<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7047","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}