Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou_create() fou_create() publishes struct fou through sk_user_data before adding the new FOU port to the per-netns list. If fou_add_to_port_list() fails, the error path frees fou while it is still reachable through sk_user_data. A concurrent receive can then dereference the freed object in fou_from_sock(). This ordering issue was previously noted in the linked discussion. The failure is reachable when local port 0 is requested. Each socket binds to a different ephemeral port, but fou_cfg_cmp() compares the requested port 0 and reports -EALREADY once an entry already exists. Release the tunnel socket before freeing fou so sk_user_data is cleared first, and defer reclamation with kfree_rcu() to protect concurrent RCU readers. This matches the lifetime handling in fou_release().
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 23461551c00628c3f3fe9cf837bf53cf8f212b63 before 0ee628a58d83e571f36ec9f07624d6845e420c50; affected 23461551c00628c3f3fe9cf837bf53cf8f212b63 before a6fca682cfa2041e31aa72cc397c4a1406eb7468; affected 23461551c00628c3f3fe9cf837bf53cf8f212b63 before b3f9c3e60aa25453774f899d25b5e61dd0bec1d5; affected 23461551c00628c3f3fe9cf837bf53cf8f212b63 before 99f4d3120b244f92e5df787152041296a2860cb5; affected 23461551c00628c3f3fe9cf837bf53cf8f212b63 before 58835985c035a8333742f829ad7e0889a082f9d3; affected 23461551c00628c3f3fe9cf837bf53cf8f212b63 before 9042867d4701728f0c6527215b11471759904d8f; affected 23461551c00628c3f3fe9cf837bf53cf8f212b63 before a28d8903bfe76089ea4bbdbff9976965f9ef8107; affected 23461551c00628c3f3fe9cf837bf53cf8f212b63 before b14361aca6350ff7907b0e9903c7b94dc7d5d4a0 |
| Linux / Linux | affected 3.18; unaffected 0 before 3.18; unaffected 5.10.271 through 5.10.*; unaffected 5.15.222 through 5.15.*; unaffected 6.1.189 through 6.1.*; unaffected 6.6.158 through 6.6.*; unaffected 6.12.111 through 6.12.*; unaffected 6.18.53 through 6.18.*; unaffected 7.1.8 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/0ee628a58d83e571f36ec9f07624d6845e420c50
- https://git.kernel.org/stable/c/a6fca682cfa2041e31aa72cc397c4a1406eb7468
- https://git.kernel.org/stable/c/b3f9c3e60aa25453774f899d25b5e61dd0bec1d5
- https://git.kernel.org/stable/c/99f4d3120b244f92e5df787152041296a2860cb5
- https://git.kernel.org/stable/c/58835985c035a8333742f829ad7e0889a082f9d3
- https://git.kernel.org/stable/c/9042867d4701728f0c6527215b11471759904d8f
- https://git.kernel.org/stable/c/a28d8903bfe76089ea4bbdbff9976965f9ef8107
- https://git.kernel.org/stable/c/b14361aca6350ff7907b0e9903c7b94dc7d5d4a0
ADP enrichment
No English description supplied.
No references supplied.