Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc_sk_dump(). Most queue-dump callsites already serialize that walk under the socket lock or sk->sk_lock.slock, but tipc_poll() calls trace_tipc_sk_poll(..., TIPC_DUMP_ALL, ...) without holding either lock. That lets the poll trace path reach tipc_list_dump() and backlog head/tail dumping while another context dequeues and frees an skb, leaving the trace helper dereferencing a stale queue entry. Stop the unlocked poll trace site from requesting queue dumps. Other queue dump trace callsites keep their existing output under the locking they already provide, while poll still emits the event itself without walking live queue members from an unlocked context.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected b4b9771bcbbd5839b0f77aba55e2f85989ed6779 before 3cd57c6b210d50fd1f7ac1720442ba5be5dc94f8; affected b4b9771bcbbd5839b0f77aba55e2f85989ed6779 before ae7fc824970888b4fdaa076819c9a6f2fcede275; affected b4b9771bcbbd5839b0f77aba55e2f85989ed6779 before 78706367fe1b98aee0a6de27c62b7f1e3035f38d; affected b4b9771bcbbd5839b0f77aba55e2f85989ed6779 before d7940bb6a8e7ab28f972c2875cb05783216312dc; affected b4b9771bcbbd5839b0f77aba55e2f85989ed6779 before 5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d; affected b4b9771bcbbd5839b0f77aba55e2f85989ed6779 before bed792737b5f1ba773054dbe984502958bdfe6ce; affected b4b9771bcbbd5839b0f77aba55e2f85989ed6779 before ac2f787980fdf4364cd5651a4c8128e59b8de3aa; affected b4b9771bcbbd5839b0f77aba55e2f85989ed6779 before b4f1719dfea023220e0e6bd892b087d76b2a6a49 |
| Linux / Linux | affected 5.0; unaffected 0 before 5.0; unaffected 5.10.265 through 5.10.*; unaffected 5.15.216 through 5.15.*; unaffected 6.1.183 through 6.1.*; unaffected 6.6.151 through 6.6.*; unaffected 6.12.103 through 6.12.*; unaffected 6.18.44 through 6.18.*; unaffected 7.1.8 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/3cd57c6b210d50fd1f7ac1720442ba5be5dc94f8
- https://git.kernel.org/stable/c/ae7fc824970888b4fdaa076819c9a6f2fcede275
- https://git.kernel.org/stable/c/78706367fe1b98aee0a6de27c62b7f1e3035f38d
- https://git.kernel.org/stable/c/d7940bb6a8e7ab28f972c2875cb05783216312dc
- https://git.kernel.org/stable/c/5e82beba4bc1f91d0e64c9c43f2b2fa9cd1c2a7d
- https://git.kernel.org/stable/c/bed792737b5f1ba773054dbe984502958bdfe6ce
- https://git.kernel.org/stable/c/ac2f787980fdf4364cd5651a4c8128e59b8de3aa
- https://git.kernel.org/stable/c/b4f1719dfea023220e0e6bd892b087d76b2a6a49
ADP enrichment
No English description supplied.
No references supplied.