veth: fix NAPI leak in XDP enable error path
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.1%
probabilidade de exploração
0.1%top 97% das CVEs
exploração observada
nãonenhuma fonte reporta
In the Linux kernel, the following vulnerability has been resolved:
veth: fix NAPI leak in XDP enable error path
During XDP enablement in veth, if xdp_rxq_info_reg() or
xdp_rxq_info_reg_mem_model() fails, the driver rolls back the changes.
However, the rollback loop:
for (i--; i >= start; i--) {
decrements the loop index 'i' before the first iteration. This
correctly skips unregistering the rxq for the failed index 'i' (as
registration failed or was already cleaned up), but it also
erroneously skips calling netif_napi_deli() for rq[i].xdp_napi.
Since netif_napi_add() was already called for index 'i', this leaves
a dangling napi_struct in the device's napi_list. When the veth
device is later destroyed, the freed queue memory (which contains the
leaked NAPI structure) can be reused.
The subsequent device teardown iterates the NAPI list and
corrupts the reallocated memory, leading to UAF.
Fix this by explicitly deleting the NAPI association for the failed
index 'i' before rolling back the successfully configured queues.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Linux · LinuxReferências
https://git.kernel.org/stable/c/4559770b2a241344d762719e674241fcc8528f02https://git.kernel.org/stable/c/4bd2e5dbe62334aae1182d0f0d260f334a49d739https://git.kernel.org/stable/c/6739027cb72da26890edd424c77080d187b2a92ehttps://git.kernel.org/stable/c/83090f5e7b54721d71875a6c224d2490b9e73050https://git.kernel.org/stable/c/a9e6707322ef215d39d4655b176c094f45f0ab52https://git.kernel.org/stable/c/d3eb258ad398cc9402bab3a5e730cd7c5b34efadhttps://git.kernel.org/stable/c/fc51373345e7e6ea73da2650cb497309c50b077a