Описание
In the Linux kernel, the following vulnerability has been resolved:
openvswitch: avoid reallocating confirmed conntrack labels
ovs_ct_get_conn_labels() adds the labels extension when a conntrack
entry does not have one. Confirmed conntracks can be read locklessly,
so adding an extension may reallocate and free the extension block
while another CPU accesses it.
Only add the extension for unconfirmed conntracks. A confirmed
conntrack without labels now fails the caller's label operation instead
of reallocating its extension storage.
A flaw was found in the Linux kernel's Open vSwitch component. When handling network connection tracking (conntrack) labels, the kernel may reallocate memory for active connections while another processor accesses it simultaneously. This race condition can lead to memory corruption, allowing an attacker to cause a system crash and a Denial of Service (DoS).
Отчет
A race in Open vSwitch conntrack label handling can occur when ovs_ct_get_conn_labels adds a labels extension to an already confirmed conntrack. Confirmed conntracks may be read locklessly, while adding the extension can reallocate and free the old extension block as another CPU is still accessing it. This creates a potential use after free condition that can cause a kernel crash and may permit broader memory corruption impact if the freed storage is reused in a controllable way. For the CVSS the PR:N is selected because a remote attacker does not need a local account when existing Open vSwitch rules apply conntrack label operations to attacker controlled traffic. Triggering still requires a suitable Open vSwitch configuration and winning a concurrency window, so AC:H is appropriate. The base assessment uses AV:A because Open vSwitch datapaths are commonly exposed to local, virtual, or data center network segments. The paranoid assessment uses AV:N where traffic from a remote network can reach the affected datapath. Impact is at least denial of service via kernel crash and in the worst defensible case may include confidentiality, integrity, and privilege escalation impact due to the potential use after free.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 8 | kernel | Affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovs_ct_get_conn_labels() adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate and free the extension block while another CPU accesses it. Only add the extension for unconfirmed conntracks. A confirmed conntrack without labels now fails the caller's label operation instead of reallocating its extension storage.
In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovs_ct_get_conn_labels() adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate and free the extension block while another CPU accesses it. Only add the extension for unconfirmed conntracks. A confirmed conntrack without labels now fails the caller's label operation instead of reallocating its extension storage.
In the Linux kernel, the following vulnerability has been resolved: o ...
In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovs_ct_get_conn_labels() adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate and free the extension block while another CPU accesses it. Only add the extension for unconfirmed conntracks. A confirmed conntrack without labels now fails the caller's label operation instead of reallocating its extension storage.
EPSS
7 High
CVSS3