Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the component responsible for traffic scheduling (taprio). A local attacker could exploit this flaw to cause a system crash or potentially execute unauthorized code by triggering a memory management error. This could lead to a complete loss of system availability or unauthorized access to sensitive data.
Technical details
A use-after-free (UAF) vulnerability exists in net/sched/sch_taprio.c within the taprio_change() function. The issue arises because the 'admin' pointer can become dangling during a scheduler switch or removal initiated by advance_sched(), as the critical section protected by q->current_entry_lock is insufficient to prevent concurrent access and freeing. An attacker with local access can trigger this race condition to cause a kernel panic or potentially achieve privilege escalation. The fix involves using rcu_replace_pointer() instead of rcu_assign_pointer() to ensure the 'admin' pointer is updated safely before the memory is scheduled for freeing via RCU.
Affected products
- Linux Linux Kernel 5.2 to 5.15.170, 5.16 to 6.1.115, 6.2 to 6.6.59, 6.7 to 6.11.6, 6.12-rc1 to 6.12-rc4
Timeline
- 2024-11-05: disclosed
- 2024-11-05: advisory
- 2024-11-01: patched
References
- https://git.kernel.org/stable/c/0d4c0d2844e4eac3aed647f948fd7e60eea56a61
- https://git.kernel.org/stable/c/2240f9376f20f8b6463232b4ca7292569217237f
- https://git.kernel.org/stable/c/2f868ce6013548a713c431c679ef73747a66fcf3
- https://git.kernel.org/stable/c/8a283a19026aaae8a773fd8061263cfa315b127f
- https://git.kernel.org/stable/c/999612996df28d81f163dad530d7f8026e03aec6
- https://git.kernel.org/stable/c/f504465970aebb2467da548f7c1efbbf36d0f44b
- https://git.kernel.org/stable/c/fe371f084073e8672a2d7d46b335c3c060d1e301