CVE-2021-47402

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sched: flower: protect fl_walk() with rcu

Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul()

also removed rcu protection of individual filters which causes following

use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain

rcu read lock while iterating and taking the filter reference and temporary

release the lock while calling arg->fn() callback that can sleep.

KASAN trace:

[ 352.773640] ==================================================================

[ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower]

[ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987

[ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2

[ 352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014

[ 352.781022] Call Trace:

[ 352.781573] dump_stack_lvl+0x46/0x5a

[ 352.78

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References