Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sock_def_readable() A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue. The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown. Fix this by converting priv->lecd to an RCU-protected pointer: - Mark priv->lecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns. v2: Switch from spinlock + sock_hold/put approach to RCU to properly fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet: 1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy. 2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue(). Note: Syzbot patch testing was attempted but the test VM terminated unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3e8b25f32f2f35549d03d77da030a24a45bdef5b; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 750a33f417f3d196b86375f8d9f8938bacf130fe; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 317843d5355062020649124eb4a0d7acbcc3f53e; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b256d055da47258e63f8b40965f276c5f23d229a; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3989740fa4978e1d2d51ecc62be1b01093e104ad; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before abc10f85a3965ac14b9ed7ad3e67b35604a63aa3; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5fbbb1ff936d7ff9528d929c1549977e8123d8a8; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 922814879542c2e397b0e9641fd36b8202a8e555 |
| Linux / Linux | affected 2.6.12; unaffected 0 before 2.6.12; unaffected 5.10.253 through 5.10.*; unaffected 5.15.203 through 5.15.*; unaffected 6.1.168 through 6.1.*; unaffected 6.6.134 through 6.6.*; unaffected 6.12.81 through 6.12.*; unaffected 6.18.22 through 6.18.*; unaffected 6.19.12 through 6.19.*; unaffected 7.0 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/3e8b25f32f2f35549d03d77da030a24a45bdef5b
- https://git.kernel.org/stable/c/750a33f417f3d196b86375f8d9f8938bacf130fe
- https://git.kernel.org/stable/c/317843d5355062020649124eb4a0d7acbcc3f53e
- https://git.kernel.org/stable/c/b256d055da47258e63f8b40965f276c5f23d229a
- https://git.kernel.org/stable/c/3989740fa4978e1d2d51ecc62be1b01093e104ad
- https://git.kernel.org/stable/c/abc10f85a3965ac14b9ed7ad3e67b35604a63aa3
- https://git.kernel.org/stable/c/5fbbb1ff936d7ff9528d929c1549977e8123d8a8
- https://git.kernel.org/stable/c/922814879542c2e397b0e9641fd36b8202a8e555