Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive. Several bridge RCU readers inspect `f->dst`, including `br_fdb_fillbuf()` through the `brforward_read()` sysfs path. These readers currently load `f->dst` multiple times and can therefore observe inconsistent values across the check and later dereference. In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change `f->dst` after the NULL check and before the `port_no` dereference, leading to a NULL-ptr-deref. Fix this by taking a single `READ_ONCE()` snapshot of `f->dst` in each affected RCU reader and using that snapshot for the rest of the access sequence. Also publish the in-place `f->dst` updates in `fdb_delete_local()` with `WRITE_ONCE()` so the readers and writer use matching access patterns.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
960b589f86c74ce582922fcb996103271081f4de to < c502fa9f094cb03d1d1685c71e2105ab359bc2b8affected960b589f86c74ce582922fcb996103271081f4de to < a6ae4511c07b91f597e461406c6330f0d4ff810eaffected960b589f86c74ce582922fcb996103271081f4de to < 1406c4e0ed1eaf8a29801ab1163d00fb7ee4359aaffected960b589f86c74ce582922fcb996103271081f4de to < 0b9e4bbfb7c949151e3acd44ed4aa33614d2e110affected960b589f86c74ce582922fcb996103271081f4de to < 81af4137a30c4c2dc694dea8cacb180bd66000efaffected960b589f86c74ce582922fcb996103271081f4de to < 5424e678f9b304e148cf5dcc047cffc7a56a3bb5affected960b589f86c74ce582922fcb996103271081f4de to < 9a2d9d4e657b23dc21f24cf139e3aeff0b61341faffected960b589f86c74ce582922fcb996103271081f4de to < df4601653201de21b487c3e7fffd464790cab808affected
Linux Linux
Default version status: affected
3.14affected0 to < 3.14unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.86 to ≤ 6.12.*unaffected6.18.27 to ≤ 6.18.*unaffected7.0.4 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c502fa9f094cb03d1d1685c71e2105ab359bc2b8 ↗
- https://git.kernel.org/stable/c/a6ae4511c07b91f597e461406c6330f0d4ff810e ↗
- https://git.kernel.org/stable/c/1406c4e0ed1eaf8a29801ab1163d00fb7ee4359a ↗
- https://git.kernel.org/stable/c/0b9e4bbfb7c949151e3acd44ed4aa33614d2e110 ↗
- https://git.kernel.org/stable/c/81af4137a30c4c2dc694dea8cacb180bd66000ef ↗
- https://git.kernel.org/stable/c/5424e678f9b304e148cf5dcc047cffc7a56a3bb5 ↗
- https://git.kernel.org/stable/c/9a2d9d4e657b23dc21f24cf139e3aeff0b61341f ↗
- https://git.kernel.org/stable/c/df4601653201de21b487c3e7fffd464790cab808 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗