In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: Fix dev use-after-free in xfrm async resumption<\/p>\n
xfrm async resumption hold skb->dev refcnt until after transport_finish.
\nHowever, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking
\ndevice reference, such as vti_rcv_cb. The subsequent async resumption
\nwill decrement the tunnel device’s reference count, which lead to uaf
\nof tunnel dev and refcnt leak of orig dev as below:<\/p>\n
unregister_netdevice: waiting for vti1 to become free. Usage count = -2<\/p>\n
Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set
\nby xfrm_rcv_cb can race with device teardown. Extend rcu protection over
\nxfrm_rcv_cb and transport_finish to prevent races.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfrm: Fix dev use-after-free in xfrm async resumption<\/p>\n
xfrm async resumption hold skb->dev refcnt until after transport_finish.
\nHow<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7127","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}