Eric Dumazet

توجد مشكلة ”الاستخدام بعد التحرير“ (UAF) في تنفيذ بروتوكول IPv6 داخل الوحدة النمطية `net/ipv6/ndisc.c`. يمكن استدعاء الدالة `ndisc send skb()` دون الاحتفاظ بأقفال RTNL (Routing Netlink) أو RCU (Read-Copy-Update)، مما يسمح بإعادة استخدام الذاكرة التي تم تحريرها مسبقًا. وقد يؤثر ذلك على سرية وسلامة وتوافر المعلومات المحمية.

تم إصلاح ثغرة أمنية في نواة لينكس. تتعلق المشكلة بالوظيفة `l3mdev l3 out()`، التي يمكن استدعاؤها دون حماية RCU. وقد يؤدي ذلك إلى مشكلة محتملة من نوع «الاستخدام بعد التحرير» (UAF). يتم استغلال الثغرة الأمنية من خلال سلسلة من استدعاءات الدوال، بما في ذلك `raw sendmsg()` و`ip push pending frames()` و`ip send skb()` و`ip local out()` و` ip local out()`، والتي تنتهي باستدعاء الدالة `l3mdev ip out()`. ولمعالجة هذه المشكلة، تمت إضافة زوج من الدوال `rcu read lock()` / `rcu read unlock()`.

تم إصلاح ثغرة أمنية في نواة لينكس. تتعلق المشكلة بالوظيفة ` ip rt update pmtu()`، التي يجب أن تستخدم حماية RCU لمنع اختفاء البنية net التي تقرأها.

تم إصلاح ثغرة أمنية في نواة Linux. تتعلق المشكلة بوظيفة ndisc alloc skb()، التي يمكن استدعاؤها دون الحفاظ على RTNL أو RCU، مما قد يؤدي إلى حالة ”الاستخدام بعد التحرير“ (UAF). لحل هذه المشكلة، تمت إضافة حماية RCU إلى وظيفة ndisc alloc skb().

تم إصلاح ثغرة أمنية في نواة لينكس. ترتبط المشكلة بالوظيفة ` neigh notify()`، التي يمكن استدعاؤها دون الحماية المناسبة، مما قد يؤدي إلى حالة «الاستخدام بعد التحرير» (UAF). ولحل هذه المشكلة، يتم استخدام حماية RCU في ` neigh notify()`.

تم تحديد ثغرة أمنية في نواة لينكس، حيث يمكن استدعاء الدالة arp xmit() دون الحماية المناسبة، مما قد يؤدي إلى مشكلة «الاستخدام بعد التحرير» (UAF). ولمعالجة هذه المشكلة، يتم استخدام حماية RCU في الدالة arp xmit() لمنع حدوث مثل هذه المشكلات.

تم إصلاح ثغرة أمنية في نواة لينكس. تتعلق المشكلة ببرنامج openvswitch، وتحديدًا بالوظيفة `ovs vport cmd fill info()`، التي يمكن استدعاؤها دون حماية RTNL أو RCU. وقد يؤدي ذلك إلى حدوث حالة «استخدام بعد التحرير» (UAF). ولإصلاح ذلك، يتم استخدام حماية RCU والوظيفة `dev net rcu()`.

تتعلق المشكلة بمعالجة نواة لينكس لحزم IPv6 التي تحتوي على رؤوس تمديد. وعلى وجه التحديد، تؤثر هذه المشكلة على الأجهزة التي تعلن عن NETIF F IPV6 CSUM، وهو مورد لحساب مجموع الاختباري لحزم TCP أو UDP البسيطة عبر IPv6. تظهر المشكلة عند استخدام حزم BIG TCP، حيث يتم إدخال رأس امتداد IPv6 IPV6 TLV JUMBO للإبلاغ عن طول الحزمة. لا يتم إرسال هذه الرأس عبر الأجهزة المادية، ولكنها موجودة في أدوات PF PACKET مثل tcpdump. التعديل الذي تسبب في المشكلة عطل عملية تفريغ حزم IPv6 ذات رؤوس التمديد عبر الأجهزة التي تدعم NETIF F IPV6 CSUM. تقوم الدالة `ipv6 has hopopt jumbo()` باختبار وجود هذا الرأس وتضمن أنه الرأس التوسعي الوحيد قبل رأس النهاية (L4). تم حل المشكلة من خلال إعادة تمكين تفريغ NETIF F IPV6 CSUM لحزم BIG TCP.

A division by zero error was reported in the MPTCP protocol of the Linux kernel. The root cause is the current bad handling of racing disconnect. After a specific commit, `sk wait data()` can return with an error and the underlying socket disconnected, resulting in a zero `rcv mss`. The error occurs when ` tcp select window()` is called, leading to a divide error. The issue is resolved by catching the error and returning without performing any additional operations on the current socket.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: A slab-use-after-free bug has been identified in the Linux kernel, specifically in the netfilter: bpf component. This issue arises when the ` nf unregister net hook()` function is deferred after exit/close time, potentially due to a missing reference on the net namespace. The bug can be triggered through the `bpf nf link release()` function, leading to a read of size 8 at a specific memory address. Eric's analysis suggests that the `bpf nf link attach()` function assigns `link->net = net` without taking a reference on the net namespace, which may cause the netns to be dismantled or freed prematurely. Recommendations: To resolve this issue, update the Linux kernel to version 6.6.61 or later. As a temporary workaround, consider restricting the use of the `bpf nf link attach()` function until a patch is available. Additionally, avoid using the `link->net` variable in the affected API endpoints until the issue is resolved.

A vulnerability in the Linux kernel has been resolved, specifically in the af packet module. The issue occurs after the sock init data() function is called in packet create(), where the allocated sk object is attached to the provided sock object. If an error occurs, packet create() frees the sk object, leaving a dangling pointer in the sock object. This can cause use-after-free errors if other code attempts to use the pointer.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.11.0-rc7-syzkaller-g5f5673607153 Description: The issue is related to a panic on IPPROTO SMC in the Linux kernel. When INET PROTOSW ICSK is set, icsk->icsk sync mss must also be set. The problem occurs due to a lack of synchronization of MSS within sys connect file for AF SMC. This can lead to a kernel NULL pointer dereference. A patch has been added to prevent such panic by performing a simple return, laying the groundwork for future support of this feature for IPPROTO SMC. Recommendations: For Linux kernel versions prior to 6.11.0-rc7-syzkaller-g5f5673607153, consider applying the patch that adds a toy implementation to prevent the panic. This patch performs a simple return to prevent the kernel NULL pointer dereference, providing a temporary solution until full support for synchronizing MSS within sys connect file for AF SMC is implemented.

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: The issue arises from insufficient sanity checks in the `qdisc pkt len init()` function, specifically when handling `SKB GSO DODGY` packets. The `virtio net hdr to skb()` function does not fully dissect TCP headers, only ensuring they are at least 20 bytes long. This allows a user to craft a malicious 'GSO' packet with a total length of 80 bytes, comprising a 20-byte IPv4 header, a 60-byte TCP header, and a small `gso size` like 8. As a result, `virtio net hdr to skb()` would incorrectly identify this packet as a normal GSO packet due to the perceived payload size being larger than `gso size`. This can lead to an underflow in `qdisc skb cb(skb)->pkt len`. Recommendations: For Linux kernel versions prior to 6.6.58, update to version 6.6.58 or later to resolve the issue. As a temporary workaround, consider implementing additional sanity checks for `SKB GSO DODGY` packets to prevent underflow in `qdisc skb cb(skb)->pkt len`. Restrict the use of `virtio net hdr to skb()` function until the update is applied to minimize the risk of exploitation.

The issue is related to a data leakage vulnerability in the Linux kernel's net: dpaa component. When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. This can be avoided by extending all packets to ETH ZLEN, ensuring nothing is leaked in the padding. The bug can be reproduced by running $ ping -s 11 destination.

The issue is related to the use of memory after it has been freed in the ip6 finish output2 function of the Linux kernel. This can lead to a denial of service. The problem occurs when skb expand head() returns NULL, indicating that the skb has been freed, and the associated dst/idev could also have been freed. To prevent this, it is necessary to hold rcu read lock() to ensure that the dst and associated idev are alive.

The issue is related to a possible use-after-free (UAF) vulnerability in the `ip6 xmit()` function of the Linux kernel. If `skb expand head()` returns NULL, it indicates that the `skb` has been freed, and the associated `dst/idev` could also have been freed. To prevent a possible UAF, it is necessary to use `rcu read lock()`. The exploitation of this vulnerability may allow an attacker to cause a denial of service.

The issue is related to the Linux kernel's TCP component, where a TCP socket using TCP USER TIMEOUT can retransmit packets every two jiffies (2 ms for HZ=1000) for about 4 minutes after TCP USER TIMEOUT has expired, if the other peer retracts its window to zero. The fix involves making sure tcp rtx probe0 timed out() takes icsk->icsk user timeout into account. Before a specific commit, the socket would not timeout after icsk->icsk user timeout, but would use standard exponential backoff for the retransmits.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the tipc component of the Linux kernel, which has a problem with incorrect input validation. This can lead to a stack overflow when a node receives and processes domain record structs from peer nodes. The function `tipc mon rcv()` is used to receive and process these structs, and it is called from the function `tipc link proto rcv()`, where a 32-bit message data length field is read into a uint16. To prevent bit overflow, an extra sanity check is added to this function. The problem was identified by Eric Dumazet. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the function `gue gro receive()` in the Linux kernel, which has a problem with incorrect input validation. This can potentially impact the confidentiality, integrity, and availability of protected information. The vulnerability is related to the handling of unsupported protocols in the `gue gro receive()` function. A packet can be easily constructed to trigger a warning, which was previously reduced from `WARN ON` to `WARN ON ONCE`. The warning has been removed as it is expected and not actionable.

The issue is related to the `ila output()` function in the Linux kernel, which can be called from `lwtunnel output()` possibly from process context, and under `rcu read lock()`. This can lead to a race condition where the function is interrupted by a softirq, causing corruption of `dst cache` data structures. The problem arises because `net/core/dst cache.c` helpers need to be called with BH disabled.