In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rxrpc: Don’t move a peeked OOB message onto the pending queue<\/p>\n
rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and,
\nif a response is needed, moves it onto the pending_oobq tree. However,
\nonly the unlink from recvmsg_oobq is guarded by MSG_PEEK; the move onto
\npending_oobq always runs.<\/p>\n
As a result, reading a challenge with MSG_PEEK leaves the skb on
\nrecvmsg_oobq while also adding it to pending_oobq. Since struct
\nsk_buff’s rbnode shares storage with its next and prev pointers,
\nrb_insert_color() overwrites the list linkage, and the skb, which holds
\na single reference, becomes reachable from both queues at once.<\/p>\n
When the socket is closed both queues are drained in turn. While
\ndraining recvmsg_oobq, __skb_unlink() follows the next and prev
\npointers that rbnode has overwritten and writes to a bad address. Also,
\nas the skb holds a single reference but is freed from each queue, both
\nthe skb and the connection reference it holds are released twice. This
\nleads to memory corruption and to a use-after-free caused by the
\nconnection refcount underflow.<\/p>\n
MSG_PEEK does not consume the message from the queue, so only unlink it
\nfrom recvmsg_oobq and then move it onto pending_oobq or free it when
\nthe message is actually consumed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
rxrpc: Don’t move a peeked OOB message onto the pending queue<\/p>\n
rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq an<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7396","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}