ورود / ثبت‌نام

جزئیات آسیب‌پذیری

CVE-2026-31419

Linux LinuxRed Hat Enterprise Linux 9

net: bonding: fix use-after-free in bond_xmit_broadcast()

CVSS 3.1
7.8بالا

شرح رسمی (انگلیسی)

In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concurrent slave enslave/release can mutate the slave list during RCU-protected iteration, changing which slave is "last" mid-loop. This causes the original skb to be double-consumed (double-freed). Replace the racy bond_is_last_slave() check with a simple index comparison (i + 1 == slaves_count) against the pre-snapshot slave count taken via READ_ONCE() before the loop. This preserves the zero-copy optimization for the last slave while making the "last" determination stable against concurrent list mutations. The UAF can trigger the following crash: ================================================================== BUG: KASAN: slab-use-after-free in skb_clone Read of size 8 at addr ffff888100ef8d40 by task exploit/147 CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:123) print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:597) skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) ip6_output (net/ipv6/ip6_output.c:250) ip6_send_skb (net/ipv6/ip6_output.c:1985) udp_v6_send_skb (net/ipv6/udp.c:1442) udpv6_sendmsg (net/ipv6/udp.c:1733) __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) __x64_sys_sendto (net/socket.c:2209) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Allocated by task 147: Freed by task 147: The buggy address belongs to the object at ffff888100ef8c80 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 192 bytes inside of freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) Memory state around the buggy address: ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================

امتیازهای CVSS

امتیازنسخهمنبعبردار
7.8بالا 3.1 CVEProject cvelistV5 (CNA) (Linux) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
7.0بالا 3.1 CVEProject cvelistV5 (CNA) (redhat-SADP) CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

محصولات آسیب‌پذیر

فروشندهمحصولنسخه‌هامنبع
Linux Linux 5.17 CVEProject cvelistV5 (CNA)
Linux Linux c1f1691ef84fa6d38fa5e5148eca073145e97ffa CVEProject cvelistV5 (CNA)
Linux Linux 20949c3816463e97c6f8fe84c0280c7e5ae83a8d ≤ v < 060d83bb6147c36fc21134d5b332d266b8c176bc CVEProject cvelistV5 (CNA)
Linux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c ≤ v < a0f661918edc79d7a75e468128af8d41e2a1a83a CVEProject cvelistV5 (CNA)
Linux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c ≤ v < d4cc7e4c80b1634c7b1497574a2fdb18df6c026c CVEProject cvelistV5 (CNA)
Linux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c ≤ v < f5b94654a4a19891a8108d66ef166de6c028c6cd CVEProject cvelistV5 (CNA)
Linux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c ≤ v < 2884bf72fb8f03409e423397319205de48adca16 CVEProject cvelistV5 (CNA)
Linux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c ≤ v < 00752893f96b344f258c9c6de18b33171ac4872c CVEProject cvelistV5 (CNA)
Linux Linux 4e5bd03ae34652cd932ab4c91c71c511793df75c ≤ v < 2de5c8eea0a9db99dae7c36f4b541b74b41d3a04 CVEProject cvelistV5 (CNA)
Linux Linux 5.10.94 ≤ v < 5.10.273 CVEProject cvelistV5 (CNA)
Linux Linux 5.15.17 ≤ v < 5.15.224 CVEProject cvelistV5 (CNA)
Linux Linux 5.16.3 ≤ v < 5.17 CVEProject cvelistV5 (CNA)
Linux Linux f1d206181f19b00b275b258fea1418718a2f4173 ≤ v < df690112b2172e8eb0f4dd8ec1019b65ee979203 CVEProject cvelistV5 (CNA)
Red Hat Red Hat Enterprise Linux 9 همه CVEProject cvelistV5 (CNA)

منابع و راهنماها

۲۹
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.

اطلاعات

تاریخ انتشار
۱۴۰۵/۰۱/۲۴
آخرین به‌روزرسانی
۱۴۰۵/۰۸/۰۸
وضعیت
منتشرشده
صادرکننده (CNA)
Linux

پیش‌بینی بهره‌برداری (EPSS)

۰٫۱۲٪
احتمال بهره‌برداری در ۳۰ روز
۲٫۵٪
صدک (نسبت به همه‌ی CVEها)

ارزیابی SSVC (CISA)

قابل خودکارسازی
خیر
وضعیت بهره‌برداری
ندارد
اثر فنی
کامل

ضعف‌ها (CWE)

  • CWE-416
    Use After Free
  • CWE-362
    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')