CVE-2024-36979

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mst: fix vlan use-after-free

syzbot reported a suspicious rcu usage[1] in bridge's mst code. While

fixing it I noticed that nothing prevents a vlan to be freed while

walking the list from the same path (br forward delay timer). Fix the rcu

usage and also make sure we are not accessing freed memory by making

br_mst_vlan_set_state use rcu read lock.

[1]

WARNING: suspicious RCU usage

6.9.0-rc6-syzkaller #0 Not tainted

-----------------------------

net/bridge/br_private.h:1599 suspicious rcu_dereference_protected() usage!

...

stack backtrace:

CPU: 1 PID: 8017 Comm: syz-executor.1 Not tainted 6.9.0-rc6-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024

Call Trace:

<IRQ>

__dump_stack lib/dump_stack.c:88 [inline]

dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114

lockdep_rcu_suspicious+0x221/0x340 kernel/locking/lockdep.c:6712

nbp_vlan_group n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References