APPLIED[L]/REJECTED[J/F]: [SRU][F/J/L][PATCH 0/1] CVE-2023-3609

[Stefan Bader]

On 03.08.23 20:43, Yuxuan Luo wrote:
> [Impact]
> A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32
> component can be exploited to achieve local privilege escalation. If
> tcf_change_indev() fails, u32_set_parms() will immediately return an
> error after incrementing or decrementing the reference counter in
> tcf_bind_filter(). If an attacker can control the reference counter and
> set it to zero, they can cause the reference to be freed, leading to a
> use-after-free vulnerability.
> 
> [Backport]
> Clean cherry pick.
> 
> [Test]
> Smoke tested via adding an u32 filter to a dummy device using `tc`.
> 
> [Potential Regression]
> Expect very low regression.
> 
> Lee Jones (1):
>    net/sched: cls_u32: Fix reference counter leak leading to overflow
> 
>   net/sched/cls_u32.c | 18 ++++++++++--------
>   1 file changed, 10 insertions(+), 8 deletions(-)
> 
This patch does not apply to Jammy because of missing

v5.17 c86e0209dc77 flow_offload: validate flags of filter and actions

in addition the function tcf_change_indev(), which is added by the 
patch, changed number of arguments with

v4.16 c86e0209dc77 flow_offload: validate flags of filter and actions

so Focal would FTBS with this.

Applied to lunar:linux/master-next. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 44613 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20230804/a34914db/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20230804/a34914db/attachment-0001.sig>