Description
In the Linux kernel, the following vulnerability has been resolved: veth: fix NAPI leak in XDP enable error path During XDP enablement in veth, if xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes. However, the rollback loop: for (i--; i >= start; i--) { decrements the loop index 'i' before the first iteration. This correctly skips unregistering the rxq for the failed index 'i' (as registration failed or was already cleaned up), but it also erroneously skips calling netif_napi_deli() for rq[i].xdp_napi. Since netif_napi_add() was already called for index 'i', this leaves a dangling napi_struct in the device's napi_list. When the veth device is later destroyed, the freed queue memory (which contains the leaked NAPI structure) can be reused. The subsequent device teardown iterates the NAPI list and corrupts the reallocated memory, leading to UAF. Fix this by explicitly deleting the NAPI association for the failed index 'i' before rolling back the successfully configured queues.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b02e5a0ebb172c8276cea3151942aac681f7a4a6 to < fc51373345e7e6ea73da2650cb497309c50b077aaffectedb02e5a0ebb172c8276cea3151942aac681f7a4a6 to < 4559770b2a241344d762719e674241fcc8528f02affectedb02e5a0ebb172c8276cea3151942aac681f7a4a6 to < 83090f5e7b54721d71875a6c224d2490b9e73050affectedb02e5a0ebb172c8276cea3151942aac681f7a4a6 to < d3eb258ad398cc9402bab3a5e730cd7c5b34efadaffectedb02e5a0ebb172c8276cea3151942aac681f7a4a6 to < a9e6707322ef215d39d4655b176c094f45f0ab52affectedb02e5a0ebb172c8276cea3151942aac681f7a4a6 to < 4bd2e5dbe62334aae1182d0f0d260f334a49d739affectedb02e5a0ebb172c8276cea3151942aac681f7a4a6 to < 6739027cb72da26890edd424c77080d187b2a92eaffected
Linux Linux
Default version status: affected
5.11affected0 to < 5.11unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a ↗
- https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02 ↗
- https://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050 ↗
- https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efad ↗
- https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52 ↗
- https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739 ↗
- https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92e ↗