lkml.org 
[lkml]   [2023]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[Consult]kernel tcp socket lack of refcnt for net may cause uaf problem?
Date
Hello, Eric:

I found upstream have fixed a UAF issue (smc: Fix use-after-free in tcp_write_timer_handler()):
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9744d2bf19762703704ecba885b7ac282c02eacf

When create a kernel socket use sock_create_kern , it won't call get_net() to increase refcnt for net where the socket is located.
I found some other subsystem(like rds and sunrpc) also use sock_create_kern to create kernel tcp socket, I want to know if they have same UAF problem?

Best wishes!


\
 
 \ /
  Last update: 2023-12-19 14:48    [W:0.035 / U:0.088 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site