clsact: Fix use-after-free in init/destroy rollback asymmetry
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.130, 6.10, 6.12.78, 6.18.20, 6.19.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: clsact: Fix use-after-free in init/destroy rollback asymmetry Fix a use-after-free in the clsact qdisc upon init/destroy rollback asymmetry. The latter is achieved by first fully initializing a clsact instance, and then in a second step having a replacement failure for the new clsact qdisc instance. clsact_init() initializes ingress first and then takes care of the egress part. This can fail midway, for example, via tcf_block_get_ext(). Upon failure, the kernel will trigger the clsact_destroy() callback. Commit 1cb6f0bae504 ("bpf: Fix too early release of tcx_entry") details the way how the transition is happening. If tcf_block_get_ext on the q->ingress_block ends up failing, we took the tcx_miniq_inc reference count on the ingress side, but not yet on the egress side. clsact_destroy() tests whether the {ingress,egress}_entry was non-NULL. However, even in midway failure on the replacement, both are in fact non-NULL with a valid egress_entry from the previous clsact instance. What we really need to test for is whether the qdisc instance-specific ingress or egress side previously got initialized. This adds a small helper for checking the miniq initialization called mini_qdisc_pair_inited, and utilizes that upon clsact_destroy() in order to fix the use-after-free scenario. Convert the ingress_destroy() side as well so both are consistent to each other.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 230bb13650b0f186f540500fd5f5f7096a822a2a · fixed in a73d95b57bf9faebdfed591bcb7ed9292062a84c; From 1cb6f0bae50441f4b4b32a28315853b279c7404e · fixed in 37bef86e5428d59f70a4da82b80f9a8f252fecbe; From 1cb6f0bae50441f4b4b32a28315853b279c7404e · fixed in 4c9af67f99aa3e51b522c54968ab3ac8272be41c; From 1cb6f0bae50441f4b4b32a28315853b279c7404e · fixed in 0509b762bc5e8ea7b8391130730c6d8502fc6e69; From 1cb6f0bae50441f4b4b32a28315853b279c7404e · fixed in a0671125d4f55e1e98d9bde8a0b671941987e208; From 6.6.41 · fixed in 6.6.130; From 6.9.10 · fixed in 6.10
- Linux Linux
6.10
- KernelLinux
fixed in 6.6.130; From 6.7.0 · fixed in 6.12.78; From 6.10.0 · fixed in 6.18.20; From 6.13.0 · fixed in 6.19.10