Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:

net: shaper: proteger de la creación tardía de la jerarquía

Buscamos un netdev durante la preparación de las operaciones de Netlink (callbacks previos) y tomamos una referencia a él. Luego, más tarde, en el cuerpo del callback, tomamos su bloqueo o RCU, que son las protecciones reales.

El netdev puede ser dado de baja entre el momento en que tomamos la referencia y el momento en que lo bloqueamos. Podemos asignar la jerarquía después de que el vaciado ya se haya ejecutado, lo que llevaría a una fuga.

Tomar el bloqueo de instancia ya en pre-, esto nos salva de la condición de carrera y elimina por completo la necesidad de callbacks dedicados de bloqueo/desbloqueo. Después de todo, si hay alguna posibilidad de que una escritura ocurra concurrentemente con el vaciado, volvemos a la fuga de la jerarquía.

Podemos tomar el bloqueo para dispositivos que no soportan shapers, pero aquí solo estamos tratando con operaciones SET; no tomar el bloqueo sería optimizar para un caso de error.

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["Documentation/netlink/specs/net_shaper.yaml","net/shaper/shaper.c","net/shaper/shaper_nl_gen.c","net/shaper/shaper_nl_gen.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"93954b40f6a4fc43226c01a15b02732f884500f1","lessThan":"719f6784f918f9e32f3ff3b197f900e852223f9d","versionType":"git","status":"affected"},{"version":"93954b40f6a4fc43226c01a15b02732f884500f1","lessThan":"d22921727023e7852704965e935f4d1fc83a5ec9","versionType":"git","status":"affected"},{"version":"93954b40f6a4fc43226c01a15b02732f884500f1","lessThan":"d75ec7e8ba1979a1eb0b9211d94d749cdce849c8","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["Documentation/netlink/specs/net_shaper.yaml","net/shaper/shaper.c","net/shaper/shaper_nl_gen.c","net/shaper/shaper_nl_gen.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.13","status":"affected"},{"version":"0","lessThan":"6.13","versionType":"semver","status":"unaffected"},{"version":"6.18.20","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"6.19.10","lessThanOrEqual":"6.19.*","versionType":"semver","status":"unaffected"},{"version":"7.0","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD-CWE-noinfo

OR
          *cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.10
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13.1 up to (excluding) 6.18.20

kernel.org: https://git.kernel.org/stable/c/719f6784f918f9e32f3ff3b197f900e852223f9d Types: Patch

kernel.org: https://git.kernel.org/stable/c/d22921727023e7852704965e935f4d1fc83a5ec9 Types: Patch

kernel.org: https://git.kernel.org/stable/c/d75ec7e8ba1979a1eb0b9211d94d749cdce849c8 Types: Patch

In the Linux kernel, the following vulnerability has been resolved:

net: shaper: protect from late creation of hierarchy

We look up a netdev during prep of Netlink ops (pre- callbacks)
and take a ref to it. Then later in the body of the callback
we take its lock or RCU which are the actual protections.

The netdev may get unregistered in between the time we take
the ref and the time we lock it. We may allocate the hierarchy
after flush has already run, which would lead to a leak.

Take the instance lock in pre- already, this saves us from the race
and removes the need for dedicated lock/unlock callbacks completely.
After all, if there's any chance of write happening concurrently
with the flush - we're back to leaking the hierarchy.

We may take the lock for devices which don't support shapers but
we're only dealing with SET operations here, not taking the lock
would be optimizing for an error case.

https://git.kernel.org/stable/c/719f6784f918f9e32f3ff3b197f900e852223f9d

https://git.kernel.org/stable/c/d22921727023e7852704965e935f4d1fc83a5ec9

https://git.kernel.org/stable/c/d75ec7e8ba1979a1eb0b9211d94d749cdce849c8