Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in offloaded map/prog info fill When querying info for an offloaded BPF map or program, bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns() obtain the network namespace with get_net(dev_net(offmap->netdev)). However, the associated netdev's netns may be racing with teardown during netns destruction. If the netns refcount has already reached 0, get_net() performs a refcount_t increment on 0, triggering: refcount_t: addition on 0; use-after-free. Although rtnl_lock and bpf_devs_lock ensure the netdev pointer remains valid, they cannot prevent the netns refcount from reaching zero. Fix this by using maybe_get_net() instead of get_net(). maybe_get_net() uses refcount_inc_not_zero() and returns NULL if the refcount is already zero, which causes ns_get_path_cb() to fail and the caller to return -ENOENT -- the correct behavior when the netns is being destroyed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
675fc275a3a2d905535207237402c6d8dcb5fa4b to < 43d6848a2a6c92ccfd614d9f0bb6fd85b95dfa9daffected675fc275a3a2d905535207237402c6d8dcb5fa4b to < 642943ae5bdacabc8109dc4a5e0ebb4a6b99ef3eaffected675fc275a3a2d905535207237402c6d8dcb5fa4b to < fea55b034328feaafef75aee252f305e6f85a991affected675fc275a3a2d905535207237402c6d8dcb5fa4b to < 5662dac41a3442aa378d7c405164903eb109fc05affected675fc275a3a2d905535207237402c6d8dcb5fa4b to < 1a2dc103e16448d022a77ad5fc3234641436c4b7affected675fc275a3a2d905535207237402c6d8dcb5fa4b to < 85dc711f742b192eb97c0e00b521312f5a7a415eaffected675fc275a3a2d905535207237402c6d8dcb5fa4b to < a51e7fbe94a87e236631a83973d4f558310b2cd2affected675fc275a3a2d905535207237402c6d8dcb5fa4b to < a0c584fc18056709c8e047a82a6045d6c209f4ceaffected
Linux Linux
Default version status: affected
4.16affected0 to < 4.16unaffected5.10.269 to ≤ 5.10.*unaffected5.15.220 to ≤ 5.15.*unaffected6.1.187 to ≤ 6.1.*unaffected6.6.156 to ≤ 6.6.*unaffected6.12.108 to ≤ 6.12.*unaffected6.18.49 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/43d6848a2a6c92ccfd614d9f0bb6fd85b95dfa9d ↗
- https://git.kernel.org/stable/c/642943ae5bdacabc8109dc4a5e0ebb4a6b99ef3e ↗
- https://git.kernel.org/stable/c/fea55b034328feaafef75aee252f305e6f85a991 ↗
- https://git.kernel.org/stable/c/5662dac41a3442aa378d7c405164903eb109fc05 ↗
- https://git.kernel.org/stable/c/1a2dc103e16448d022a77ad5fc3234641436c4b7 ↗
- https://git.kernel.org/stable/c/85dc711f742b192eb97c0e00b521312f5a7a415e ↗
- https://git.kernel.org/stable/c/a51e7fbe94a87e236631a83973d4f558310b2cd2 ↗
- https://git.kernel.org/stable/c/a0c584fc18056709c8e047a82a6045d6c209f4ce ↗