diff options
| author | Breno Leitao <leitao@debian.org> | 2026-07-21 01:58:45 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-07-23 10:27:08 -0700 |
| commit | 0f71f852a96af9685858ce59fda34ecbf85c283d (patch) | |
| tree | 6256457ebb1b470c4264fd4fc52c0bba53b38560 /include/uapi/linux/rfkill.h | |
| parent | b9e558976bb968162c35ddccdb076a77fc906993 (diff) | |
| download | linux-0f71f852a96af9685858ce59fda34ecbf85c283d.tar.gz linux-0f71f852a96af9685858ce59fda34ecbf85c283d.zip | |
phonet: pep: fix use-after-free in pep_get_sb()
pep_get_sb() doesn't consider that pskb_may_pull() might have relocated
the skb data, and continue to access the older pointer, causing UAF.
Reproduced under KASAN:
BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0
Read of size 1 at addr ff11000105510f50 by task repro/157
pep_get_sb+0x234/0x3b0
pipe_handler_do_rcv+0x5f7/0xa10
pep_do_rcv+0x203/0x410
__sk_receive_skb+0x471/0x4a0
phonet_rcv+0x5b3/0x6c0
__netif_receive_skb+0xcc/0x1d0
Refetch the header with skb_header_pointer() after pskb_may_pull(), so
the possibly stale pointer is no longer dereferenced. There are better
ways to solve this, but, this is the less instrusive one.
Fixes: 9641458d3ec4 ("Phonet: Pipe End Point for Phonet Pipes protocol")
Cc: stable@vger.kernel.org
Signed-off-by: Breno Leitao <leitao@debian.org>
Link: https://patch.msgid.link/20260721-phonet_get_sb_uaf-v1-1-95fd7881cc4e@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/uapi/linux/rfkill.h')
0 files changed, 0 insertions, 0 deletions