Linux Kernel batman-adv OGM Aggregation Vulnerability on Disabled Interfaces

A vulnerability exists in the Linux kernel's batman-adv module, specifically related to the handling of OGM (Optimized Geometric Mesh) packet aggregation on disabled hard interfaces. When a hard interface is disabled, the corresponding aggregation list is freed. However, the function responsible for sending OGM packets can still enqueue new packets to the aggregation list. This queuing continues until the RCU-protected list of hard interfaces is no longer accessible, leading to a situation where the queued packets are neither processed nor freed, causing a memory leak. The issue arises because the interface disable function does not properly block the queuing of OGM packets, allowing for a buildup of unhandled data.

Impact

The vulnerability leads to a memory leak, where queued OGM packets are not processed or freed, potentially causing increased memory usage over time.

Reproduction

To reproduce this vulnerability, disable a hard interface that is currently aggregating OGM packets. After disabling the interface, observe that the aggregation list is cleared, but the OGM sending function can still add new packets to the list. These packets will remain unprocessed and cause a memory leak until the RCU-protected list of hard interfaces is no longer accessible.

Remediation

The batman-adv OGM interface disable function should be modified to properly block the queuing of OGM packets, preventing them from being added to the aggregation list when the interface is disabled.