High · published March 3, 2024
In the Linux kernel, the following vulnerability has been resolved:
net: fix possible store tearing in neigh_periodic_work()
While looking at a related syzbot report involving neigh_periodic_work(),
I found that I forgot to add an annotation when deleting an
RCU protected item from a list.
Readers use rcu_deference(*np), we need to use either
rcu_assign_pointer() or WRITE_ONCE() on writer side
to prevent store tearing.
I use rcu_assign_pointer() to have lockdep support,
this was the choice made in neigh_flush_dev().
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 2.6.37, < 5.4.258 | 5.4.258 |
| linux/linux_kernel | ≥ 5.5, < 5.10.198 | 5.10.198 |
| linux/linux_kernel | ≥ 5.11, < 5.15.135 | 5.15.135 |
| linux/linux_kernel | ≥ 5.16, < 6.1.57 | 6.1.57 |
| linux/linux_kernel | ≥ 6.2, < 6.5.7 | 6.5.7 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |