REDHAT-BUG-2513293: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: fix use-after-free of a severed iucvpath
afiucv queues not-yet-received message notifications on iucv->messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath() frees that path with iucvpathfree() but leaves the notifications queued. A later recvmsg() drains messageq via iucvprocessmessageq() and hands the stale path to messagereceive() -- a use-after-free of the freed iucvpath.
Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel AF_IUCV networking functionality are exposed when queued message notifications can reference an IUCV path that a peer has severed. The issue involves AF_IUCV socket message handling rather than general network socket processing.
What event is needed to trigger the use-after-free?
A peer must sever an IUCV connection while message notifications for that connection remain queued. A later recvmsg() operation that drains the queued notifications can then pass the freed IUCV path to message_receive().
What is the mitigation if an updated kernel cannot be deployed immediately?
The provided information identifies the vulnerable path as AF_IUCV message handling. Avoiding use of AF_IUCV connections, particularly where peers can sever connections with messages still queued, prevents the described trigger.
How can administrators determine whether the described condition may have occurred?
The condition requires queued AF_IUCV message notifications, severing of the associated connection by a peer, and a subsequent recvmsg() that processes the queue. The provided information does not specify a log message, detection signature, or other indicator for confirming exploitation.