Към съдържанието
Търсене

CVE-2021-47103: Linux

9.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearly documenting it. And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv() are not following standard RCU rules. [a] dst_release(dst); [b] sk->sk_rx_dst = NULL; They look wrong because a delete operation of RCU protected pointer is supposed to clear the pointer before the call_rcu()/synchronize_rcu() guarding actual memory freeing. In some cases indeed, dst could be freed before [b] is done. We could cheat by clearing sk_rx_dst before calling dst_release(), but this seems the right time to stick to standard RCU annotations and debugging facilities. [1] BUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline] BUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 Read of size 2 at addr ffff88807f1cb73a by task syz-executor.5/9204 CPU: 0 PID: 9204 Comm: syz-executor.5 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x320 mm/kasan/report.c:247 __kasan_report mm/kasan/report.c:433 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:450 dst_check include/net/dst.h:470 [inline] tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792 ip_rcv_finish_core.constprop.0+0x15de/0x1e80 net/ipv4/ip_input.c:340 ip_list_rcv_finish.constprop.0+0x1b2/0x6e0 net/ipv4/ip_input.c:583 ip_sublist_rcv net/ipv4/ip_input.c:609 [inline] ip_list_rcv+0x34e/0x490 net/ipv4/ip_input.c:644 __netif_receive_skb_list_ptype net/core/dev.c:5508 [inline] __netif_receive_skb_list_core+0x549/0x8e0 net/core/dev.c:5556 __netif_receive_skb_list net/

Засегнати продукти

  • Linux Linux: 41063e9dd11956f2d285e12e4342e1d232ba0ea2 преди 68c34ce11ef23328692aa35fa6aaafdd75913100; 41063e9dd11956f2d285e12e4342e1d232ba0ea2 преди 92e6e36ecd16808866ac6172b9491b5097cde449; 41063e9dd11956f2d285e12e4342e1d232ba0ea2 преди 75a578000ae5e511e5d0e8433c94a14d9c99c412; 41063e9dd11956f2d285e12e4342e1d232ba0ea2 преди c3bb4a7e8cbc984e1cdac0fe6af60e880214ed6e; 41063e9dd11956f2d285e12e4342e1d232ba0ea2 преди f039b43cbaea5e0700980c2f0052da05a70782e0; 41063e9dd11956f2d285e12e4342e1d232ba0ea2 преди 0249a4b8a554f2eb6a27b62516fa50168584faa4; 41063e9dd11956f2d285e12e4342e1d232ba0ea2 преди 8f905c0e7354ef261360fb7535ea079b1082c105
  • Linux Linux: 3.6; преди 3.6; 4.9.331 до 4.9.*; 4.14.296 до 4.14.*; 4.19.262 до 4.19.*; 5.4.220 до 5.4.*; 5.10.150 до 5.10.*; 5.15.12 до 5.15.*; от 5.16 нататък

История

  • 4 март 2024 Публикувано

Други уязвимости в Linux Linux

Първоизточници