Beat
Linux Kernel
Upstream Linux kernel development news
A leftover giant-packet mark on an IP fragment can panic the host
A tap or a guest can attach giant-packet metadata to a single IP fragment. After the host glues the pieces back together, that leftover mark sends the kernel into a BUG that panics the machine.
Eight stable kernels for Thursday
Eight stable and longterm updates landed, from 7.2.1 down through 5.10.267. The tip tree alone carries dozens of fixes, including use-after-free and out-of-bounds holes in Bluetooth, HID, IPv6, and NFC.
Zram can walk off its table after a shrink reset
Compressed RAM swap keeps a table of slots sized to the device. If the device is reset smaller while writeback or memory tracking is still running, those paths could keep the old size and scan past the new table. Both paths now read the size only after taking the device lock.
AppArmor writes past a profile-name list when a process sets its own confinement
AppArmor builds a list of profile names when a process asks to change its own confinement. The list was one slot short for the terminator, so a long compound name wrote a pointer past the end.
AppArmor can free a process's credentials while they are still in use
AppArmor is the Linux security module that pins a confinement profile to each process. When a profile was replaced or disabled, it swapped that process's credentials from inside filesystem work, so a later lookup could touch freed memory.
A bad SMB server could free a buffer the client still uses
After a first multi-part reply is accepted, a malformed follow-up can make the client drop the original buffer while the receive path still holds a pointer to it. The next packet then writes into freed memory.
A bad SMB server could make the client write off a reply buffer
The kernel SMB client stitches multi-part replies together using offsets the server chooses. Those offsets were not checked against the buffer, so a hostile or broken server could point the copy below the payload or past the end of the heap object.
A reconnect on the kernel SMB server could use a freed session
Two clients can hold durable handles on the same file. After both drop off, one reconnect can take over the other's lease state and later walk a session that has already been freed.
Two lock requests on the kernel SMB server could free the same memory
A logged-in client can send a batch of lock operations and an unlock at the same time. If a later lock in the batch fails, the server undoes the earlier ones after another request may already have freed them. That is a use-after-free and a double free.
A logged-in SMB client could overflow a control reply
A client that is already on a share can pack a later control request into a bundled message after earlier replies have used up most of the buffer. Two of those control replies were written at full size anyway, past the remaining space, into nearby kernel memory.
The kernel SMB server could write past a Kerberos login reply
When a client logs in with Kerberos as part of a bundled request, the server miscounted how much room was left in its reply. A large login token could then be copied past the end of that buffer into nearby kernel memory.
Open vSwitch can crash when a flow is deleted
Deleting a flow from Open vSwitch can free packet-match data while the kernel is still building the delete reply. A short race then reads that memory and can crash the host.
Stable and LTS kernels moved
7.1.9 and six long-term lines moved. These are the first stable drops since 7.1.8, 6.18.44, and 6.12.103.
Linux 7.2 is out
Linus tagged 7.2. The last release candidate was 7.2-rc7.
Unprivileged users could read a DRBD cluster secret
DRBD is the kernel's shared-disk replication. After a netlink rewrite, two status dumps stopped hiding the authentication secret, and those dumps do not require admin rights.
Registered I/O buffers could overflow on 32-bit kernels
The kernel's fast I/O path lets a process register big buffers once and reuse them. On 32-bit machines a size check wrapped around, so the kernel reserved a tiny slot and then wrote a much larger array over the heap.
OpenRISC signal return let a local process drop memory protection
OpenRISC is a small CPU architecture used in QEMU and on FPGA boards. A local process could return from a signal with a crafted frame that turned off memory protection, then read and write any physical address.
A bad Ceph storage server could make the client kernel read past a reply
The kernel's Ceph client parses replies from storage servers when you mount a Ceph volume or use RBD. A hostile or broken server that already has a session can send a short or garbage reply and make that client read past the end of the buffer.
A dead process-ID namespace could still take new IDs
Process IDs live in a hierarchy of namespaces, the same objects containers use to hide one group's processes from another. A mainline fix now refuses to hand out a new ID when any ancestor namespace in that chain is already dead.
A file copy asked the wrong owner if the source was readable
When copying a file between two stacked filesystems, the kernel asked the destination's mounter if the source was readable. A read that should have been denied can go through.
A namespace admin could rewrite a tunnel that lives somewhere else
Changing a virtual tunnel checked admin rights in the wrong network namespace. A process that is admin where the device sits could rewrite a tunnel whose underlay lives elsewhere.
A stranger can make the kernel SMB server read past a short packet
The in-kernel SMB server skipped its size check on a certain short packet, then read past the request and could send those bytes back. If that server is listening, the sender does not need to log in.
A known peer can free memory the network stack still uses
A known peer can send authenticated address-change messages that free memory the stack still uses. This is not a random packet from the internet.
A load balancer could write off the stack on an error packet
A load balancer rewrites ICMP errors that bounce back through a tunnel. Leftover IPv4 option data let that rewrite copy too much onto the stack.
A timer could fire after a virtual tunnel was already torn down
A virtual tunnel that was already down could still have a cleanup timer armed. When it fired, it could write through memory that had been freed.