[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZrN2VCc9hM_mahCS@sashalap>
Date: Wed, 7 Aug 2024 09:27:48 -0400
From: Sasha Levin <sashal@...nel.org>
To: Siddh Raman Pant <siddh.raman.pant@...cle.com>
Cc: "stable@...r.kernel.org" <stable@...r.kernel.org>,
"pablo@...filter.org" <pablo@...filter.org>,
"gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>,
"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: CVE-2024-39503: netfilter: ipset: Fix race between namespace
cleanup and gc in the list:set type
On Wed, Aug 07, 2024 at 06:42:14AM +0000, Siddh Raman Pant wrote:
>On Fri, 12 Jul 2024 14:21:09 +0200, Greg Kroah-Hartman wrote:
>> In the Linux kernel, the following vulnerability has been resolved:
>>
>> netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type
>>
>> Lion Ackermann reported that there is a race condition between namespace cleanup
>> in ipset and the garbage collection of the list:set type. The namespace
>> cleanup can destroy the list:set type of sets while the gc of the set type is
>> waiting to run in rcu cleanup. The latter uses data from the destroyed set which
>> thus leads use after free. The patch contains the following parts:
>>
>> - When destroying all sets, first remove the garbage collectors, then wait
>> if needed and then destroy the sets.
>> - Fix the badly ordered "wait then remove gc" for the destroy a single set
>> case.
>> - Fix the missing rcu locking in the list:set type in the userspace test
>> case.
>> - Use proper RCU list handlings in the list:set type.
>>
>> The patch depends on c1193d9bbbd3 (netfilter: ipset: Add list flush to cancel_gc).
>
>This commit does not exist in stable kernels. Please backport it.
>
> netfilter: ipset: Add list flush to cancel_gc
>
> Flushing list in cancel_gc drops references to other lists right away,
> without waiting for RCU to destroy list. Fixes race when referenced
> ipsets can't be destroyed while referring list is scheduled for destroy.
>
>Since this is missing, the CVE fix potentially introduced new races as
>it makes use of RCU.
Indeed, looks like it was missing on older trees. I'll queue it up.
Thanks!
--
Thanks,
Sasha
Powered by blists - more mailing lists