Wen Gu

تتعلق المشكلة بنواة لينكس، وتحديدًا بمكون net/smc. عند تلقي رسالة اقتراح على الخادم، لا يمكن الاعتماد بشكل كامل على الحقلين `iparea offset` و`ipv6 prefixes cnt` الخاصين بالعميل البعيد. إذا تجاوز `iparea offset` قيمته القصوى، فقد يؤدي ذلك إلى الوصول إلى عنوان غير صحيح، مما قد يتسبب في تعطل النظام. يعمل التصحيح على حل هذه المشكلة عن طريق التحقق من `iparea offset` و`ipv6 prefixes cnt` قبل استخدامهما.

A use-after-free issue was encountered in the Linux kernel, specifically in the net/smc component. This issue manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making resource access unsafe. The problem is caused by repeated release of LGR/link refcnt, potentially due to smc conn free() being called repeatedly without sock lock protection.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a refcount leak in the `smc ib find route()` function, which may cause the disclosure of confidential information. The leak occurs because the neighbour found by `neigh lookup()` and the rtable resolved by `ip route output flow()` are not released or put before return. This may lead to a refcount leak. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A crash was found when dumping SMC-D connections in the Linux kernel. The issue can be reproduced by running a specific test and continuously dumping SMC-D connections in parallel. The crash is caused by a kernel NULL pointer dereference, which occurs when the connection is in the process of being established and the `rmb desc` has not yet been initialized. The vulnerability can be exploited to cause a denial of service.

The issue is related to a kernel NULL pointer dereference in the `smc setsockopt()` function, caused by accessing `smc->clcsock` after it has been released. This can lead to a crash. The problem is addressed by holding `clcsock release lock` and checking whether `clcsock` has already been released before access. The patch also checks `smc->clcsock` in `smc getsockopt()` and `smc switch to fallback()` to prevent similar crashes.

A race condition in the `net/smc` component can lead to a kernel panic and denial of service. The issue occurs when the `smc cdc tx handler()` function attempts to access `smc sock` after it has already been freed by the `smc release()` function. This use-after-free scenario happens because `smc release()` may dismiss and release the socket before `smc cdc tx handler()` completes its access, despite initial checks for the connection's existence.