In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush<\/p>\n
nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop
\nreplace without holding nh->lock, racing the unlocked IPv6 route
\nadd\/delete that mutate the list under nh->lock and free fib6_info
\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):<\/p>\n
BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net\/ipv4\/nexthop.c:2243)
\n Read of size 8 at addr ffff888012953e18 by task exploit\/146
\n nh_rt_cache_flush (net\/ipv4\/nexthop.c:2243)
\n replace_nexthop (net\/ipv4\/nexthop.c:2610)
\n rtm_new_nexthop (net\/ipv4\/nexthop.c:3323)
\n rtnetlink_rcv_msg (net\/core\/rtnetlink.c:7076)<\/p>\n
Unlike the other f6i_list walks, this one bumps each route’s sernum via
\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock
\naround it would invert the established tb6_lock -> nh->lock order and
\ndeadlock. As the only purpose is to invalidate cached dsts, bump the
\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,
\nmirroring the rt_cache_flush() already done for IPv4 just above.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush<\/p>\n
nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nextho<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7574","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}