In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock…
Info
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt to 3. Lockless readers such as __inet_lookup_established() handle this with refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain sock_hold() while holding the bucket lock, on the assumption that th…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd
- https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396
- https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24
- https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df
- https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74
- https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51
Timeline
- nvd_ingest NVD