Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix kernel panic when enabling bearer
When enabling a bearer on a node, a kernel panic is observed:
[ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc]
…
[ 4.520030] Call Trace:
[ 4.520689]
The node in question is receiving activate messages in another thread after changing bearer status to allow message sending/ receiving in current thread:
| thread 1 | thread 2 |
|---|---|
| tipc_enable_bearer() | |
| test_and_set_bit_lock() | |
| tipc_bearer_xmit_skb() | |
| tipc_l2_rcv_msg() | |
| tipc_rcv() | |
| __tipc_node_link_up() | |
| tipc_link_build_state_msg() | |
| tipc_link_build_proto_msg() | |
| tipc_mon_prep() | |
| { | |
| … | |
| // null-pointer dereference | |
| u16 gen = mon->dom_gen; | |
| … | |
| } | |
| // Not being executed yet | |
| tipc_mon_create() | |
| { | |
| … | |
| // allocate | |
| mon = kzalloc(); | |
| … | |
| } |
Monitoring pointer in thread 2 is dereferenced before monitoring data is allocated in thread 1. This causes kernel panic.
This commit fixes it by allocating the monitoring data before enabling the bearer to receive messages.
Details
- Affected product:
- CentOS 8.4 ELS , CentOS 8.5 ELS , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS
- Affected packages:
- linux-hwe @ 4.15.0 (+3 more)
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix kernel panic when enabling bearer
When enabling a bearer on a node, a kernel panic is observed:
[ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc]
…
[ 4.520030] Call Trace:
[ 4.520689]
The node in question is receiving activate messages in another thread after changing bearer status to allow message sending/ receiving in current thread:
| thread 1 | thread 2 |
|---|---|
| tipc_enable_bearer() | |
| test_and_set_bit_lock() | |
| tipc_bearer_xmit_skb() | |
| tipc_l2_rcv_msg() | |
| tipc_rcv() | |
| __tipc_node_link_up() | |
| tipc_link_build_state_msg() | |
| tipc_link_build_proto_msg() | |
| tipc_mon_prep() | |
| { | |
| … | |
| // null-pointer dereference | |
| u16 gen = mon->dom_gen; | |
| … | |
| } | |
| // Not being executed yet | |
| tipc_mon_create() | |
| { | |
| … | |
| // allocate | |
| mon = kzalloc(); | |
| … | |
| } |
Monitoring pointer in thread 2 is dereferenced before monitoring data is allocated in thread 1. This causes kernel panic.
This commit fixes it by allocating the monitoring data before enabling the bearer to receive messages.