net: bridge: fix use-after-free due to MST port state bypass
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.1.159, 6.6.117, 6.12.58, 6.17.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: net: bridge: fix use-after-free due to MST port state bypass syzbot reported[1] a use-after-free when deleting an expired fdb. It is due to a race condition between learning still happening and a port being deleted, after all its fdbs have been flushed. The port's state has been toggled to disabled so no learning should happen at that time, but if we have MST enabled, it will bypass the port's state, that together with VLAN filtering disabled can lead to fdb learning at a time when it shouldn't happen while the port is being deleted. VLAN filtering must be disabled because we flush the port VLANs when it's being deleted which will stop learning. This fix adds a check for the port's vlan group which is initialized to NULL when the port is getting deleted, that avoids the port state bypass. When MST is enabled there would be a minimal new overhead in the fast-path because the port's vlan group pointer is cache-hot. [1] https://syzkaller.appspot.com/bug?extid=dd280197f0f7ab3917be
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From ec7328b59176227216c461601c6bd0e922232a9b · fixed in e19085b2a86addccff33ab8536fc67ebd9d52198; From ec7328b59176227216c461601c6bd0e922232a9b · fixed in 3b60ce334c1ce8b3fad7e02dcd5ed9f6646477c8; From ec7328b59176227216c461601c6bd0e922232a9b · fixed in bf3843183bc3158e5821b46f330c438ae9bd6ddb; From ec7328b59176227216c461601c6bd0e922232a9b · fixed in 991fbe1680cd41a5f97c92cd3a3496315df36e4b; From ec7328b59176227216c461601c6bd0e922232a9b · fixed in 8dca36978aa80bab9d4da130c211db75c9e00048
- Linux Linux
5.18
- KernelLinux
From 5.18.0 · fixed in 6.1.159; From 6.2.0 · fixed in 6.6.117; From 6.7.0 · fixed in 6.12.58; From 6.13.0 · fixed in 6.17.8