In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
um: vector: fix use-after-free in vector_mmsg_rx()<\/p>\n
When vector_mmsg_rx() discards a packet whose overlay header fails
\nverify_header(), it frees the skb and continues the loop:<\/p>\n
\tif (header_check estats.rx_encaps_errors++;
\n\t\tcontinue;
\n\t}<\/p>\n
The normal and short-packet paths fall through to the bottom of the
\nloop body, which clears the consumed slot and advances the cursors:<\/p>\n
\t(*skbuff_vector) = NULL;
\n\tmmsg_vector++;
\n\tskbuff_vector++;<\/p>\n
The verify_header() < 0 path skips that via continue, so the freed skb
\nis left in skbuff_vector[] and the cursors do not advance. The next
\niteration reads the same slot, gets the freed skb, and frees it again,
\nproducing a refcount underflow \/ use-after-free in the RX path.<\/p>\n
Discard the slot the same way the other paths do before continuing.<\/p>\n
Only transports whose verify_header() can return negative are affected:
\nGRE and L2TPv3 do so on a cookie\/session-id mismatch (raw\/tap do not),
\nso any peer on such a transport can trigger it without authentication.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
um: vector: fix use-after-free in vector_mmsg_rx()<\/p>\n
When vector_mmsg_rx() discards a packet whose overlay header fails
\nverify_heade<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7468","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7468","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7468"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7468"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7468"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}