net: serialize netif_running() check in enqueue_to_backlog()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.3, 3.5, 3.13, 3.15, 3.19, and 4 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: net: serialize netif_running() check in enqueue_to_backlog() Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup(). The root cause is a race condition where packets can escape the backlog flushing during device unregistration (e.g., during netns exit). Commit e9e4dd3267d0 ("net: do not process device backlog during unregistration") introduced a lockless netif_running() check in enqueue_to_backlog() to prevent queuing packets to an unregistering device. However, this creates a TOCTOU race window. A lockless transmitter (like veth_xmit) can pass the check before dev_close() clears IFF_UP. If the transmitter is then delayed, flush_all_backlogs() can run and finish before the transmitter grabs the backlog lock and queues the packet. The packet then escapes the flush and triggers UAF later when processed. Fix this by moving the netif_running() check inside the backlog lock. This serializes the check with the flush work (which also grabs the lock). We then either queue the packet before the flush runs (so it gets flushed), or check netif_running() after the flush/close completes (so it gets dropped).
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From e9e4dd3267d0c5234c5c0f47440456b10875dec9 · fixed in cbe10ea090ea9d6fa5ff50c9b44f2a86fe56f0b7; From e9e4dd3267d0c5234c5c0f47440456b10875dec9 · fixed in b422e3eff0edf0975de4883929adbed28f9d08bc; From e9e4dd3267d0c5234c5c0f47440456b10875dec9 · fixed in 2fface6e0bbd6314d1d9d071abf2c4d67548511c; From e9e4dd3267d0c5234c5c0f47440456b10875dec9 · fixed in 46762cefe7f4e5bffc1eb467810a7bbb02e461d7; From 3.2.71 · fixed in 3.3; From 3.4.111 · fixed in 3.5; From 3.12.48 · fixed in 3.13; From 3.14.54 · fixed in 3.15; From 3.18.22 · fixed in 3.19; From 4.1.9 · fixed in 4.2
- Linux Linux
4.2
- KernelLinux
From 4.2.0 · fixed in 6.12.114; From 6.13.0 · fixed in 6.18.57; From 6.19.0 · fixed in 7.1.5