Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
net: mctp: hold a reference to the route device in mctp_route_lookup()
mctp_route_lookup() uses rt->dev without holding a reference on it. mctp_route_lookup_single() returns the route under RCU only, so the route’s device can be torn down concurrently: mctp_dev_put() drops the last reference and synchronously kfree()s mdev->addrs. mctp_dev_saddr() then reads rt->dev->addrs[0], giving a use-after-free reachable by an unprivileged local AF_MCTP user on the receive/forwarding path (no CAP_NET_RAW required):
BUG: KASAN: slab-use-after-free in mctp_route_lookup Read of size 1 at addr … by task mctp_uaf/… mctp_route_lookup mctp_pkttype_receive Freed by task …: kfree mctp_dev_put mctp_dev_notify
In the same window mctp_dst_from_route() -> mctp_dev_hold() also increments a refcount that has already reached zero (“refcount_t: addition on 0 … mctp_dev_hold”).
This reintroduces the use-after-free class of CVE-2023-3439: the source address lookup was moved ahead of the point where the destination takes its device reference.
Take a reference with refcount_inc_not_zero() before touching rt->dev, skip a device that is already dead, and drop the reference once the destination has taken its own.
Details
- Affected product:
- Debian 10 ELS , Debian 11 ELS
- Affected packages:
- linux @ 4.19.0 (+1 more)