Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: atlantic: free RX pages of consumed but not refilled buffers<br /> <br /> aq_ring_rx_deinit() only walks [sw_head, sw_tail), the region posted to<br /> hardware. Since the page reuse strategy was added, a cleaned RX buffer<br /> keeps its page (and its DMA mapping) in the ring for reuse, and refill<br /> is batched: aq_ring_rx_fill() returns early until AQ_CFG_RX_REFILL_THRES<br /> slots are free. Slots that were consumed but not yet reposted therefore<br /> sit in the complementary [sw_tail, sw_head) gap with a live page, and<br /> the deinit walk never visits them: up to a refill batch worth of pages<br /> and DMA mappings leak on every interface down.<br /> <br /> Walk the whole ring instead and release whatever is still there. Also<br /> bail out if the buffer ring is already gone: a partial<br /> aq_ptp_ring_alloc() failure frees the ring but leaves aq_nic set, so<br /> aq_ptp_ring_deinit() still gets here on the unwind path.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: bridge: release template ct on non-IP path<br /> <br /> A bridge nftables ct zone set rule can attach a conntrack template to<br /> an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6<br /> EtherTypes, nf_ct_bridge_pre() currently overwrites skb-&gt;_nfct with<br /> IP_CT_UNTRACKED without releasing the existing template reference.<br /> <br /> That makes the per-cpu template, and any temporary templates allocated<br /> for concurrent use, unreachable and leaks memory until the host runs out<br /> of slab.<br /> <br /> Reset the skb conntrack state before marking the frame untracked so the<br /> existing template reference is dropped on the non-IP path.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: devmem: prevent net-iov / page mixing<br /> <br /> We should either have net_iov or page backed frags in a single skb,<br /> otherwise it blows up down the stack. Don&amp;#39;t allow mixing in<br /> zerocopy_fill_skb_from_devmem().

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/dibs: Correct freeing of dmb_clientid_arr<br /> <br /> A dibs device interrupt handler can be active after dibs_dev_del() and<br /> may still access dmb_clientid_arr. (UAF)<br /> <br /> In case of a failure in dibs_dev_add() being called by dibs_lo_dev_probe()<br /> dmb_clientid_arr is freed twice (double free).<br /> <br /> Free dmb_clientid_arr in dibs_dev_release() after last reference is gone.<br /> Note that allocating in dibs_dev_add() instead of dibs_dev_alloc() is ok<br /> for now, because no dmbs can be registered before dibs_dev_add().

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: prevent in6_dev_get() from resurrecting inet6_dev<br /> <br /> in6_dev_get() reads dev-&gt;ip6_ptr under RCU and then unconditionally<br /> increments its refcount. Device teardown can clear the pointer and drop<br /> the last reference between these operations. The increment then<br /> resurrects an object whose RCU free has already been queued, so callers<br /> can use it after it is freed.<br /> <br /> Use refcount_inc_not_zero() and return NULL when the object has already<br /> reached zero. RCU keeps the memory accessible through the attempted<br /> reference acquisition, and a successful increment pins the object for<br /> the caller.<br /> <br /> An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)<br /> kernel reproduced the invalid reference acquisition as UID 1000:<br /> <br /> refcount_t: addition on 0; use-after-free.<br /> ip6_mc_source+0xef4/0x17e0<br /> <br /> It was followed by the corresponding reference underflow in<br /> ip6_mc_source(). The supplied trace from the same unpatched revision<br /> additionally shows the access after the RCU read-side section ends:<br /> <br /> BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0<br /> Write of size 8 at addr ffff888015b50240 by task poc/1219<br /> <br /> Bug found and triaged by OpenAI Security Research and<br /> validated by Trail of Bits.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: atlantic: free stranded TX buffers on ring deinit<br /> <br /> aq_vec_deinit() drains the TX rings with a single aq_ring_tx_clean()<br /> call, which frees at most AQ_CFG_TX_CLEAN_BUDGET (256) descriptors and<br /> stops at hw_head, which no longer moves once aq_vec_stop() has stopped<br /> the hardware and NAPI. Completed descriptors beyond the budget and<br /> everything still posted in [hw_head, sw_tail) keep their skb or<br /> xdp_frame when the interface goes down: aq_vec_ring_free() then frees<br /> the buffer ring and the references are lost for good.<br /> <br /> Today this is a silent memory leak on every interface down under<br /> TX/XDP_TX load. With the conversion of the RX path to page_pool posted<br /> for net-next it becomes much more visible: XDP_TX frames carry fragment<br /> references on the RX ring&amp;#39;s page_pool, so a single stranded frame keeps<br /> the pool&amp;#39;s inflight count above zero forever. page_pool_destroy() then<br /> never completes, the pool is leaked together with its pages, and<br /> "page_pool_release_retry() stalled pool shutdown" is warned every 60<br /> seconds from that point on, on every ifdown, XDP detach or ring resize<br /> under XDP_TX load.<br /> <br /> Bring back aq_ring_tx_deinit() as it was before the removal and use it<br /> for teardown again, with one extension: TX rings can hold xdp_frames<br /> nowadays, so release those too. They are returned with<br /> xdp_return_frame() since this runs in process context.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_conntrack: defer invalid log until after unlock<br /> <br /> TCP and SCTP conntrack paths can emit invalid-packet logs while ct-&gt;lock<br /> is still held.<br /> <br /> When invalid logging is routed to nfnetlink_log and conntrack export is<br /> enabled, the log path can re-enter conntrack netlink glue and dump the<br /> same conntrack again. Protocol attribute dumping may take ct-&gt;lock, so<br /> logging while holding that lock can deadlock.<br /> <br /> Defer the TCP invalid logs by storing only the minimal log context while<br /> ct-&gt;lock is held and emitting the log after unlocking. Also make the TCP<br /> timeout-lowering invalid path return whether a log is needed, then emit<br /> that log after unlocking.<br /> <br /> Do the same for the SCTP invalid state-transition log that can be reached<br /> while ct-&gt;lock is held.<br /> <br /> Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers<br /> that log invalid conntracks while holding ct-&gt;lock are caught outside TCP<br /> and SCTP as well.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> NTB: ntb_netdev: Preserve RX queue depth on allocation failure<br /> <br /> ntb_netdev_rx_handler() hands the received skb to the network stack<br /> before allocating its replacement. If the allocation fails, nothing is<br /> reposted. Every failure therefore takes one buffer out of the RX queue<br /> while the interface remains up, and enough failures eventually stall<br /> reception.<br /> <br /> A retry path could refill the queue later, but ntb_netdev has none.<br /> Allocate the replacement first instead. If that fails, drop the packet<br /> and repost the same skb. This keeps the queue full and lets packet<br /> delivery resume as soon as memory is available again.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/x25: fix use-after-free of the socket by its timers<br /> <br /> The x25 timers are armed with mod_timer() and cancelled with<br /> timer_delete(), so a pending timer holds no reference on the socket and a<br /> cancel does not wait for a callback already running on another CPU.<br /> <br /> x25_heartbeat_expiry() also rearms unconditionally, so it can reinstall<br /> sk-&gt;sk_timer after __x25_destroy_socket() has passed its cancel point.<br /> The following __sock_put() frees the socket while the timer is still<br /> queued, and the next expiry uses freed memory. KASAN reports a<br /> slab-use-after-free on the kmalloc-2k object freed by close().<br /> <br /> timer_delete_sync() cannot be used here: x25_heartbeat_expiry() and<br /> x25_timer_expiry() both reach the cancels from inside the timer they<br /> would wait on, through __x25_destroy_socket() and x25_disconnect().<br /> <br /> Arm the timers with sk_reset_timer() and cancel them with sk_stop_timer()<br /> so that an armed timer owns a reference, and release it in both expiry<br /> handlers. Rearm the heartbeat only while sk_hashed(sk) is still true,<br /> since __x25_destroy_socket() unlinks the socket before dropping it. Arm<br /> the deferred destroy timer the same way and drop its reference in<br /> x25_destroy_timer().<br /> <br /> Reproduced on net with KASAN, with the heartbeat period shortened so the<br /> window recurs. With this patch the reproducer no longer triggers a<br /> report and /proc/net/x25 drains.<br /> <br /> Discovered by XBOW, triaged by Baul Lee

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vsock/virtio: read virtqueues under worker locks<br /> <br /> Commit bd50c5dc182b ("vsock/virtio: add support for device<br /> suspend/resume") made the *_run flags transition from false to true when<br /> restore installs replacement virtqueues. The RX, TX and event workers<br /> read their virtqueue before locking and checking the corresponding flag,<br /> so a worker delayed across freeze and restore can observe the replacement<br /> queue&amp;#39;s running state while retaining a pointer to the deleted queue.<br /> <br /> Read each virtqueue under its mutex after checking the run flag, keeping<br /> the pointer and state in the same queue generation.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vxlan: do not arm the ageing timer on a device that is down<br /> <br /> vxlan_changelink() arms vxlan-&gt;age_timer whenever the requested ageing<br /> interval differs from the configured one:<br /> <br /> if (conf.age_interval != vxlan-&gt;cfg.age_interval)<br /> mod_timer(&amp;vxlan-&gt;age_timer, jiffies);<br /> <br /> There is no netif_running() test, so the timer is armed even on a device<br /> that was never brought up. The only synchronous cancel in the driver is<br /> the timer_delete_sync() in vxlan_stop(), which is .ndo_stop.<br /> netif_close_many() drops devices without IFF_UP before<br /> __dev_close_many() runs, so that cancel is skipped for such a device.<br /> <br /> vxlan_setup() sets dev-&gt;needs_free_netdev = true and age_timer is a<br /> member of struct vxlan_dev, so free_netdev() releases the allocation the<br /> timer lives in while it is still queued on a timer_base.<br /> expire_timers() unlinks the entry before it loads timer-&gt;function, so<br /> the timer core writes through the freed object&amp;#39;s list pointers:<br /> <br /> BUG: KASAN: slab-use-after-free in __run_timers+0x208/0x654<br /> Write of size 8 at addr ffff00001adace68 by task true/192<br /> __asan_store8+0x84/0xac<br /> __run_timers+0x208/0x654<br /> run_timer_softirq+0x154/0x18c<br /> Allocated by task 189:<br /> alloc_netdev_mqs+0x64/0x720<br /> rtnl_create_link+0x4ac/0x520<br /> rtnl_newlink+0x758/0xd00<br /> Freed by task 191:<br /> netdev_release+0x40/0x58<br /> netdev_run_todo+0x4a4/0x8c0<br /> rtnl_dellink+0x200/0x4e8<br /> <br /> The rtnl operations involved are netns-scoped, so an unprivileged user<br /> can perform them in a new user and network namespace.<br /> <br /> Arming the timer on a down device never had an effect: vxlan_cleanup()<br /> returns early on !netif_running(), and vxlan_open() arms the timer for<br /> any non-zero interval once the device is brought up. Add the missing<br /> test.<br /> <br /> Discovered by XBOW, triaged by Baul Lee

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xdp: reject clones that overrun skb_shared_info tailroom<br /> <br /> xdpf_clone() clones broadcast copies into a single page and sets<br /> frame_sz to PAGE_SIZE. __xdp_build_skb_from_frame() later treats that<br /> page like a normal XDP frame and expects the usual skb_shared_info<br /> tailroom at the end of the buffer.<br /> <br /> The current check only rejects frames whose linear xdp_frame header,<br /> headroom, and packet data exceed PAGE_SIZE. A source frame backed by a<br /> larger allocation can still satisfy that check while extending into the<br /> clone&amp;#39;s required shared-info area. When such a clone is converted back<br /> into an skb, build_skb_around() places skb_shared_info over live packet<br /> bytes and later writes can corrupt XDP return metadata.<br /> <br /> Reject clones unless their linear area fits inside<br /> SKB_WITH_OVERHEAD(PAGE_SIZE), matching the tailroom requirement already<br /> enforced by the XDP-to-skb conversion path.