CVE-2024-44934

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: mcast: wait for previous gc cycles when removing port

syzbot hit a use-after-free[1] which is caused because the bridge doesn't

make sure that all previous garbage has been collected when removing a

port. What happens is:

CPU 1 CPU 2

start gc cycle remove port

acquire gc lock first

wait for lock

call br_multicasg_gc() directly

acquire lock now but free port

the port can be freed

while grp timers still

running

Make sure all previous gc cycles have finished by using flush_work before

freeing the port.

[1]

BUG: KASAN: slab-use-after-free in br_multicast_port_group_expired+0x4c0/0x550 net/bridge/br_multicast.c:861

Read of size 8 at addr ffff888071d6d000 by task syz.5.1232/9699

CPU: 1 PID: 9699 Comm: syz.5.1232 Not tainted 6.10.0-rc5-syzkaller-00021-g24ca36a562d6 #0

Hardware name: Google Google Compute Engi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References