In the Linux kernel, the following vulnerability has been resolved:
tipc: fix UAF in tipc_l2_send_msg()
Syzbot reported a slab-use-after-free in ipvlan_hard_header() when
called from tipc_l2_send_msg().
The root cause is that tipc_disable_l2_media() calls synchronize_net()
while b->media_ptr is still valid. This allows concurrent RCU readers
to obtain the device pointer after synchronize_net() has finished.
The pointer is cleared later in bearer_disable(), but without any
subsequent synchronization, allowing the device to be freed while
still in use by readers.
Fix this by clearing b->media_ptr in tipc_disable_l2_media() before
calling synchronize_net().
This is safe to do now because the call order in bearer_disable()
was reversed in 0d051bf93c06 ("tipc: make bearer packet filtering generic")
to call tipc_node_delete_links() (which needs the pointer) before
disable_media().
https: //lore.kernel.org/netdev/6a2c1007.428ffe26.258b27.015d.GAE@google.com/T/#u
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - tipc_l2_send_msg is reached from tipc_bearer_xmit during L2 TIPC protocol handling; remote ETH_P_TIPC frames on cluster/datacenter L2 networks drive outbound transmission that races with bearer teardown in tipc_disable_l2_media.
AC:L - The UAF window is a race where attackers control both sides by flooding TIPC Ethernet traffic while bearer disable runs and by concurrently triggering bearer teardown; syzbot reliably reproduced this without attacker-uncontrollable timing.
PR:N - An unauthenticated remote attacker only needs to send TIPC L2 frames on a segment with an active bearer; bearer_disable teardown during cluster failover, netdev unregister, or node shutdown creates the required concurrent disable without attacker-local privileges.
UI:N - No victim user action is required; exploitation is triggered by remote protocol traffic concurrent with automated or administrative bearer/interface teardown events.
S:U - Impact is kernel slab memory corruption and potential privilege escalation within the same kernel security boundary, not a cross-VM or cross-namespace escape.
C:H - Slab use-after-free of a net_device structure via ipvlan_hard_header enables reading freed kernel heap memory and can be leveraged for arbitrary kernel memory disclosure.
I:H - UAF on net_device during dev_hard_header allows heap grooming and control of freed object contents, enabling arbitrary kernel writes and potential code execution.
A:H - The UAF causes kernel oops/panic (as reported by syzbot in ipvlan_hard_header) and can be triggered repeatedly to deny service on cluster nodes.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - tipc_l2_send_msg is reached from tipc_bearer_xmit during L2 TIPC protocol handling; remote ETH_P_TIPC frames on cluster/datacenter L2 networks drive outbound transmission that races with bearer teardown in tipc_disable_l2_media.
AC:L - The UAF window is a race where attackers control both sides by flooding TIPC Ethernet traffic while bearer disable runs and by concurrently triggering bearer teardown; syzbot reliably reproduced this without attacker-uncontrollable timing.
PR:N - An unauthenticated remote attacker only needs to send TIPC L2 frames on a segment with an active bearer; bearer_disable teardown during cluster failover, netdev unregister, or node shutdown creates the required concurrent disable without attacker-local privileges.
UI:N - No victim user action is required; exploitation is triggered by remote protocol traffic concurrent with automated or administrative bearer/interface teardown events.
S:U - Impact is kernel slab memory corruption and potential privilege escalation within the same kernel security boundary, not a cross-VM or cross-namespace escape.
C:H - Slab use-after-free of a net_device structure via ipvlan_hard_header enables reading freed kernel heap memory and can be leveraged for arbitrary kernel memory disclosure.
I:H - UAF on net_device during dev_hard_header allows heap grooming and control of freed object contents, enabling arbitrary kernel writes and potential code execution.
A:H - The UAF causes kernel oops/panic (as reported by syzbot in ipvlan_hard_header) and can be triggered repeatedly to deny service on cluster nodes.
CVSS 3.1