In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive. Several bridge RCU readers inspect `f->dst`, including `br_fdb_fillbuf()` through the `brforward_read()` sysfs path. These readers currently load `f->dst` multiple times and can therefore observe inconsistent values across the check and later dereference. In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change `f->dst` after the NULL check and before the `port_no` dereference, leading to a NULL-ptr-deref. Fix this by taking a single `READ_ONCE()` snapshot of `f->dst` in each affected RCU reader and using that snapshot for the rest of the access sequence. Also publish the in-place `f->dst` updates in `fdb_delete_local()` with `WRITE_ONCE()` so the readers and writer use matching access patterns.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-476
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23549fe700> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2357ccd0c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2357ccea00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2357ccfcc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23549fdf00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23549fda40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d2357cce380> | Operating System |
| linux | linux_kernel | 3.14 | <built-in method update of dict object at 0x7d242a88b240> | Operating System |
| linux | linux_kernel | 3.14 | <built-in method update of dict object at 0x7d24246074c0> | Operating System |
| linux | linux_kernel | 3.14 | <built-in method update of dict object at 0x7d23549ffa40> | Operating System |
| linux | linux_kernel | 3.14 | <built-in method update of dict object at 0x7d2424606740> | Operating System |
| linux | linux_kernel | 3.14 | <built-in method update of dict object at 0x7d23af077500> | Operating System |
| linux | linux_kernel | 3.14 | <built-in method update of dict object at 0x7d23af075080> | Operating System |
| linux | linux_kernel | 3.14 | <built-in method update of dict object at 0x7d239fbdc240> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:3.14:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:3.14:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:3.14:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:3.14:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:3.14:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:3.14:rc7:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:3.14:rc8:*:*:*:*:*:* |