REDHAT-BUG-2432664: Medium severity linux/kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
macvlan: fix possible UAF in macvlanforwardsource()
Add RCU protection on (struct macvlansourceentry)->vlan.
Whenever macvlanhashdelsource() is called, we must clear entry->vlan pointer before RCU grace period starts.
This allows macvlanforwardsource() to skip over entries queued for freeing.
Note that macvlandev are already RCU protected, as they are embedded in a standard netdev (netdevpriv(ndev)).
https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE/T/#u
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply a code change that adds RCU protection on struct macvlan_source_entry->vlan and ensure macvlan_hash_del_source() clears entry->vlan pointer before the RCU grace period starts so macvlan_forward_source() will skip entries queued for freeing.
Linux kernel (macvlan) macvlan_source_entry->vlan RCU protection / macvlan_hash_del_source behavior = clear pointer before RCU grace period