Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: defer hook memory release until rcu readers are done Yiming Qian reports UaF when concurrent process is dumping hooks via nfnetlink_hooks: BUG: KASAN: slab-use-after-free in nfnl_hook_dump_one.isra.0+0xe71/0x10f0 Read of size 8 at addr ffff888003edbf88 by task poc/79 Call Trace: <TASK> nfnl_hook_dump_one.isra.0+0xe71/0x10f0 netlink_dump+0x554/0x12b0 nfnl_hook_get+0x176/0x230 [..] Defer release until after concurrent readers have completed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
84601d6ee68ae820dec97450934797046d62db4b to < d016c216bc75c45128160593a77b864a04dbe7c0affected84601d6ee68ae820dec97450934797046d62db4b to < cb2bf5efdb02a2a59faf603604a1066e8266f349affected84601d6ee68ae820dec97450934797046d62db4b to < c25e0dec366ae99b7264324ce3c7cbaea34691f9affected84601d6ee68ae820dec97450934797046d62db4b to < 54244d54a971c26a0cd0a9073460ff71f3c51b32affected84601d6ee68ae820dec97450934797046d62db4b to < 24f90fa3994b992d1a09003a3db2599330a5232aaffected
Linux Linux
Default version status: affected
6.4affected0 to < 6.4unaffected6.6.130 to ≤ 6.6.*unaffected6.12.78 to ≤ 6.12.*unaffected6.18.20 to ≤ 6.18.*unaffected6.19.10 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d016c216bc75c45128160593a77b864a04dbe7c0 ↗
- https://git.kernel.org/stable/c/cb2bf5efdb02a2a59faf603604a1066e8266f349 ↗
- https://git.kernel.org/stable/c/c25e0dec366ae99b7264324ce3c7cbaea34691f9 ↗
- https://git.kernel.org/stable/c/54244d54a971c26a0cd0a9073460ff71f3c51b32 ↗
- https://git.kernel.org/stable/c/24f90fa3994b992d1a09003a3db2599330a5232a ↗