Linux Kernel Bridge Component Sleep in Atomic Context Vulnerability

A vulnerability has been identified in the Linux kernel's bridge component, specifically within the 'brport_store()' function of the 'br_sysfs_if.c' file. This function has historically required a bridge lock to protect the Spanning Tree Protocol (STP) state. However, it now handles various attributes that do not require this lock, such as bridge flags, FDB port flushing, multicast attributes, group forward masks, and backup ports. The unnecessary locking can lead to issues, as the function 'dev_set_promiscuity()'—called when certain bridge port flags change—can sleep, causing a disruption in atomic context. The vulnerability arises from the improper management of locks when processing attributes that do not require the bridge lock, creating a risk of sleeping functions being called from an invalid context, which can lead to kernel panics.

Impact

Exploitation of this vulnerability can cause a kernel panic by invoking sleeping functions from an invalid context, disrupting the normal operation of the kernel.

Reproduction

The vulnerability can be reproduced by changing certain bridge port flags through the sysfs interface, which triggers the 'brport_store()' function. This function will then call 'dev_set_promiscuity()' while holding the bridge lock, leading to a kernel panic due to the violation of atomic context.

Remediation

The vulnerability has been addressed by modifying the 'brport_store()' function to only acquire the bridge lock when processing STP-related attributes that require it. Users should apply the latest patches available in the Linux kernel stable tree to mitigate this issue.