Description
In the Linux kernel, the following vulnerability has been resolved: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync Yue Sun reported a use-after-free and debugobjects warning in udp_tunnel_nic_device_sync_work() during concurrent device operations. The workqueue core clears the internal pending bit before invoking the worker. At that point, a concurrent thread can queue the work again. When the already running worker eventually clears the work_pending flag to 0, it mistakenly clears the flag for the newly queued instance. udp_tunnel_nic_unregister() then observes work_pending as 0 and frees the structure while the second work item is still active in the queue, leading to UAF. Fix this by returning early in udp_tunnel_nic_device_sync() if work_pending is already set, preventing redundant work queueing.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cc4e3835eff474aa274d6e1d18f69d9d296d3b76 to < d59d3b19e1cd1a01a6db59705327387a30aed153affectedcc4e3835eff474aa274d6e1d18f69d9d296d3b76 to < f49ed02fd8c98da823fdd7b00d64a8cc1d1883acaffectedcc4e3835eff474aa274d6e1d18f69d9d296d3b76 to < cee6688e5731c0591643521716d1a1a5c1a98bf8affectedcc4e3835eff474aa274d6e1d18f69d9d296d3b76 to < 9075efb9b2c1d9d7a8285c937b64aa93ca0c41b7affectedcc4e3835eff474aa274d6e1d18f69d9d296d3b76 to < 54292b167466cdf42176b7b6f01da66c184deb12affectedcc4e3835eff474aa274d6e1d18f69d9d296d3b76 to < ecf69d4b43370c587e48d4d70289dbdb7e039d4daffected
Linux Linux
Default version status: affected
5.9affected0 to < 5.9unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d59d3b19e1cd1a01a6db59705327387a30aed153 ↗
- https://git.kernel.org/stable/c/f49ed02fd8c98da823fdd7b00d64a8cc1d1883ac ↗
- https://git.kernel.org/stable/c/cee6688e5731c0591643521716d1a1a5c1a98bf8 ↗
- https://git.kernel.org/stable/c/9075efb9b2c1d9d7a8285c937b64aa93ca0c41b7 ↗
- https://git.kernel.org/stable/c/54292b167466cdf42176b7b6f01da66c184deb12 ↗
- https://git.kernel.org/stable/c/ecf69d4b43370c587e48d4d70289dbdb7e039d4d ↗