REDHAT-BUG-2400629: Medium severity linux-kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
can: j1939: implement NETDEVUNREGISTER notification handler
syzbot is reporting
unregisternetdevice: waiting for vcan0 to become free. Usage count = 2
problem, for j1939 protocol did not have NETDEVUNREGISTER notification handler for undoing changes made by j1939skbind().
Commit 25fe97cb7620 ("can: j1939: move j1939privput() into skdestruct callback") expects that a call to j1939privput() can be unconditionally delayed until j1939sksockdestruct() is called. But we need to call j1939privput() against an extra ref held by j1939skbind() call (as a part of undoing changes made by j1939skbind()) as soon as NETDEVUNREGISTER notification fires (i.e. before j1939sksockdestruct() is called via j1939skrelease()). Otherwise, the extra ref on "struct j1939priv" held by j1939skbind() call prevents "struct netdevice" from dropping the usage count to 1; making it impossible for unregisternetdevice() to continue.
[mkl: remove space in front of label]
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2400629?
The severity of REDHAT-BUG-2400629 is classified as moderate.
How do I fix REDHAT-BUG-2400629?
To fix REDHAT-BUG-2400629, you should update your Linux kernel to the latest version that addresses this vulnerability.
Which versions of Linux kernel are affected by REDHAT-BUG-2400629?
The affected version of the Linux kernel for REDHAT-BUG-2400629 is specifically version 5.0.
What causes the issue in REDHAT-BUG-2400629?
The issue in REDHAT-BUG-2400629 is caused by the absence of a NETDEV_UNREGISTER notification handler in the j1939 protocol.
Is there a workaround for REDHAT-BUG-2400629?
Currently, there is no established workaround for REDHAT-BUG-2400629 other than applying the kernel update.