In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/smc: fix socket use-after-free during link group termination<\/p>\n
__smc_lgr_terminate() drops conns_lock after finding a connection in
\nlgr->conns_all, but before taking a reference on its socket. The connection
\nis embedded in the socket, and its registration reference protects it only
\nwhile the connection remains in the tree.<\/p>\n
A concurrent close can unregister the connection and drop that reference,
\nfreeing the socket before the termination worker reaches sock_hold().<\/p>\n
The race is reachable when close overlaps link group termination.
\nLocal stress testing reproduced the use-after-free and KASAN reported:<\/p>\n
BUG: KASAN: slab-use-after-free in __smc_lgr_terminate.part.0 [smc]
\n Write of size 4 by task kworker\/3:3
\n Workqueue: events smc_lgr_terminate_work [smc]
\n __smc_lgr_terminate.part.0 [smc]<\/p>\n
The socket was allocated by smc_create(), freed through
\nslab_free_after_rcu_debug(), and was followed by:<\/p>\n
refcount_t: addition on 0; use-after-free.
\n __smc_lgr_terminate.part.0 [smc]<\/p>\n
Take the socket reference while conns_lock still protects the tree entry.
\nThe unregister path then cannot drop the last reference until termination
\nhas finished using the socket.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/smc: fix socket use-after-free during link group termination<\/p>\n
__smc_lgr_terminate() drops conns_lock after finding a connection<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7488","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}