Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
61b1ab4583e275af216c8454b9256de680499b19 to < 8a6ecab3847c213ce2855b0378e63ce839085de3affected61b1ab4583e275af216c8454b9256de680499b19 to < 421b1ae1574dfdda68b835c15ac4921ec0030182affected61b1ab4583e275af216c8454b9256de680499b19 to < 1d79471414d7b9424d699afff2aa79fff322f52daffected61b1ab4583e275af216c8454b9256de680499b19 to < 53717f8a4347b78eac6488072ad8e5adbaff38d9affected61b1ab4583e275af216c8454b9256de680499b19 to < 8cbe2a21d85727b66d7c591fd5d83df0d8c4f757affected61b1ab4583e275af216c8454b9256de680499b19 to < dc1a481359a72ee7e548f1f5da671282a7c13b8faffected61b1ab4583e275af216c8454b9256de680499b19 to < a343811ef138a265407167294275201621e9ebb2affected61b1ab4583e275af216c8454b9256de680499b19 to < 134121bfd99a06d44ef5ba15a9beb075297c0821affected
Linux Linux
Default version status: affected
2.6.39affected0 to < 2.6.39unaffected5.4.301 to ≤ 5.4.*unaffected5.10.246 to ≤ 5.10.*unaffected5.15.195 to ≤ 5.15.*unaffected6.1.156 to ≤ 6.1.*unaffected6.6.112 to ≤ 6.6.*unaffected6.12.53 to ≤ 6.12.*unaffected6.17.3 to ≤ 6.17.*unaffected6.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8a6ecab3847c213ce2855b0378e63ce839085de3 ↗
- https://git.kernel.org/stable/c/421b1ae1574dfdda68b835c15ac4921ec0030182 ↗
- https://git.kernel.org/stable/c/1d79471414d7b9424d699afff2aa79fff322f52d ↗
- https://git.kernel.org/stable/c/53717f8a4347b78eac6488072ad8e5adbaff38d9 ↗
- https://git.kernel.org/stable/c/8cbe2a21d85727b66d7c591fd5d83df0d8c4f757 ↗
- https://git.kernel.org/stable/c/dc1a481359a72ee7e548f1f5da671282a7c13b8f ↗
- https://git.kernel.org/stable/c/a343811ef138a265407167294275201621e9ebb2 ↗
- https://git.kernel.org/stable/c/134121bfd99a06d44ef5ba15a9beb075297c0821 ↗