CVE-2024-36883

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: fix out-of-bounds access in ops_init<br /> <br /> net_alloc_generic is called by net_alloc, which is called without any<br /> locking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It<br /> is read twice, first to allocate an array, then to set s.len, which is<br /> later used to limit the bounds of the array access.<br /> <br /> It is possible that the array is allocated and another thread is<br /> registering a new pernet ops, increments max_gen_ptrs, which is then used<br /> to set s.len with a larger than allocated length for the variable array.<br /> <br /> Fix it by reading max_gen_ptrs only once in net_alloc_generic. If<br /> max_gen_ptrs is later incremented, it will be caught in net_assign_generic.