Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: ovpn: avoid putting unrelated P2P peer on socket release ovpn_peer_release_p2p() is called when an OVPN UDP socket is being destroyed. It checks the currently published P2P peer and releases it only if that peer still uses the socket being destroyed. A peer replacement can publish a new peer before the old UDP socket is destroyed. When the old socket destruction path runs afterwards, ovpn_peer_release_p2p() observes the new peer through ovpn->peer. Since the new peer uses a different socket, the function takes the socket mismatch branch. That branch still calls ovpn_peer_put(peer). At this point, however, peer is the currently published replacement peer, not the peer associated with the socket being destroyed. Dropping its reference can free it while ovpn->peer still points to it, leading to later use-after-free accesses from the peer and socket cleanup paths. KASAN reports this as a slab-use-after-free on the kmalloc-1k ovpn_peer object. In the reproducer, the object is allocated from ovpn_peer_new() via ovpn_nl_peer_new_doit(), and freed through ovpn_peer_release_rcu() from RCU callback processing. Observed access sites include ovpn_peer_remove(), ovpn_socket_release(), ovpn_nl_peer_del_notify(), and unlock_ovpn(). Fix this by returning from the socket mismatch branch without putting the peer.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected f6226ae7a0cd47aaa9175aca6a1e19600f884cbf before c5bf6b39be235ef578af4d39872f0c68cda3b937; affected f6226ae7a0cd47aaa9175aca6a1e19600f884cbf before 016a50379d17b886d12a4efa5211a418e035fe70; affected f6226ae7a0cd47aaa9175aca6a1e19600f884cbf before b52c5103f64ee825996ca1ab8df7283cde8c5f86 |
| Linux / Linux | affected 6.16; unaffected 0 before 6.16; unaffected 6.18.42 through 6.18.*; unaffected 7.1.6 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.