Vulnerability in Linux Kernel: net: sched: flower: protect fl_walk() with rcu
Summary
UVI-2021-1001716: net: sched: flower: protect fl_walk() with rcu. Affects Kernel versions >= d39d714969cda5cbda291402c8c6b1fb1047f42e, < dab4677bdbffa5c8270e79e34e51c89efa0728a0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware. It is a critical piece of software that enables the functioning of various devices and services on Linux-based systems. The net subsystem within the Linux Kernel handles network-related operations, including traffic control and packet processing. One of the components in the net subsystem is the scheduler (sched), which manages the allocation of network resources. The flower module within the scheduler provides flow-based packet classification and action rules. However, a vulnerability has been discovered in the flower module that could potentially be exploited by attackers.
Vulnerability Detail
The vulnerability in the flower module of the Linux Kernel's scheduler (sched) is related to the fl_walk() function. The fl_walk() function is responsible for traversing the flow tables used by the flower module. However, this function is not protected by RCU (Read-Copy Update) synchronization, which can lead to a use-after-free vulnerability. An attacker could potentially manipulate the flow tables in a way that triggers the use-after-free condition, allowing them to execute arbitrary code or cause a denial-of-service (DoS) condition. The impact and attack plausibility of this vulnerability have not been proven yet, but it is important to address it to ensure the security and stability of Linux-based systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch provided in commit dab4677bdbffa5c8270e79e34e51c89efa0728a0 manually. Here is an example of the patch:
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1239,6 +1239,7 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg)
struct flow_cls_offload *f;
struct tcf_exts *exts;
struct tcf_result *res;
+ rcu_read_lock();
if (arg->skip_sw && tp->chain->filter_chain)
return;
@@ -1252,6 +1253,7 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg)
goto next;
exts = rcu_dereference_bh(f->exts);
+ rcu_read_unlock();
/*
* If the filter is offloaded, we need to call the offload
Conclusion
The vulnerability in the flower module of the Linux Kernel's scheduler (sched) can be mitigated by updating the kernel to version v5.14.10 or later. It is important to address this vulnerability to ensure the security and stability of Linux-based systems. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and providing an interface for applications to interact with the hardware.
The net subsystem in the Linux Kernel handles network-related operations, including traffic control and packet processing.
The flower module within the scheduler provides flow-based packet classification and action rules.
RCU (Read-Copy Update) synchronization is a mechanism used in the Linux Kernel to allow efficient read access to shared data structures while minimizing the impact on write operations.
The vulnerability could potentially allow attackers to execute arbitrary code or cause a denial-of-service (DoS) condition on Linux-based systems.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
