netdev - Re: [Patch net] atm: fix a UAF in lec_arp_clear

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20200504.120045.2188101121107984298.davem@davemloft.net>
Date:   Mon, 04 May 2020 12:00:45 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     xiyou.wangcong@...il.com
Cc:     netdev@...r.kernel.org, l.dmxcsnsbh@...il.com
Subject: Re: [Patch net] atm: fix a UAF in lec_arp_clear_vccs()

From: Cong Wang <xiyou.wangcong@...il.com>
Date: Fri,  1 May 2020 11:11:08 -0700

> Gengming reported a UAF in lec_arp_clear_vccs(),
> where we add a vcc socket to an entry in a per-device
> list but free the socket without removing it from the
> list when vcc->dev is NULL.
> 
> We need to call lec_vcc_close() to search and remove
> those entries contain the vcc being destroyed. This can
> be done by calling vcc->push(vcc, NULL) unconditionally
> in vcc_destroy_socket().
> 
> Another issue discovered by Gengming's reproducer is
> the vcc->dev may point to the static device lecatm_dev,
> for which we don't need to register/unregister device,
> so we can just check for vcc->dev->ops->owner.
> 
> Reported-by: Gengming Liu <l.dmxcsnsbh@...il.com>
> Signed-off-by: Cong Wang <xiyou.wangcong@...il.com>

Applied.