Description
In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous running state, clears po->num, unregisters the protocol hook when needed, drops po->bind_lock, and later restores po->num and re-registers the hook from the saved was_running value. That unlocked window can race with NETDEV_UNREGISTER. The notifier can observe the socket as not running, skip __unregister_prot_hook(), and invalidate the per-socket binding by setting po->ifindex to -1 and clearing po->prot_hook.dev. A one-member fanout group can still retain its shared fanout hook device pointer. When packet_set_ring() resumes, re-registering solely from the stale was_running state can re-add the fanout hook after the device has been unregistered. Treat po->ifindex == -1 as an invalidated binding after reacquiring po->bind_lock. This is distinct from ifindex 0, the normal unbound/wildcard state: ifindex -1 marks an existing device binding that was invalidated when the device was unregistered. Restore po->num as before, but do not re-register the hook if device unregister already detached the socket.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
dc99f600698dcac69b8f56dda9a8a00d645c5ffc to < acb40ebfa5c4d62f84339fcbf713f2a9fd033a71affecteddc99f600698dcac69b8f56dda9a8a00d645c5ffc to < c820f4b7f2fa38f8769db0d0cefdd94e2721504daffecteddc99f600698dcac69b8f56dda9a8a00d645c5ffc to < 4628efbdc7affd094181f5263e65c1062e31f15faffecteddc99f600698dcac69b8f56dda9a8a00d645c5ffc to < 80ec024d53a05c60ad1d08968dcf745f10c1665caffecteddc99f600698dcac69b8f56dda9a8a00d645c5ffc to < 0a052e0808e015e68144a9877e6ef42b952c49faaffecteddc99f600698dcac69b8f56dda9a8a00d645c5ffc to < 1bc55c29cd85818e9052f17deb287d5a11fb817faffecteddc99f600698dcac69b8f56dda9a8a00d645c5ffc to < a885387dae7986a55bae5c77a15bdd447f64e9b9affecteddc99f600698dcac69b8f56dda9a8a00d645c5ffc to < 50aff80475abd3533eef4320477037e6fcc6b56eaffected
Linux Linux
Default version status: affected
3.1affected0 to < 3.1unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/acb40ebfa5c4d62f84339fcbf713f2a9fd033a71 ↗
- https://git.kernel.org/stable/c/c820f4b7f2fa38f8769db0d0cefdd94e2721504d ↗
- https://git.kernel.org/stable/c/4628efbdc7affd094181f5263e65c1062e31f15f ↗
- https://git.kernel.org/stable/c/80ec024d53a05c60ad1d08968dcf745f10c1665c ↗
- https://git.kernel.org/stable/c/0a052e0808e015e68144a9877e6ef42b952c49fa ↗
- https://git.kernel.org/stable/c/1bc55c29cd85818e9052f17deb287d5a11fb817f ↗
- https://git.kernel.org/stable/c/a885387dae7986a55bae5c77a15bdd447f64e9b9 ↗
- https://git.kernel.org/stable/c/50aff80475abd3533eef4320477037e6fcc6b56e ↗