Linux Kernel Valid Marking Vulnerability in Net Shaper Component

A vulnerability has been identified in the Linux kernel's net shaper component, related to the handling of validity markings in the XArray data structure. This issue arises from a race condition where a reader can observe a VALID mark, get interrupted, and then fetch a different entry that no longer corresponds to the original VALID mark. This can lead to a use-after-free condition, as the net_shaper_rollback() function assumes that entries without a VALID mark can be safely freed. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, potentially allowing for arbitrary memory access or manipulation.

Reproduction

The vulnerability can be reproduced by creating a net shaper entry and marking it as VALID. Then, interrupt the process before the entry is fully committed, allowing a writer to replace the entry with a different one. When the interrupted process resumes and fetches the entry, it will receive a pointer that no longer corresponds to the original VALID mark, creating a race condition. This can be observed by monitoring the net_shaper_rollback() function, which will incorrectly free an entry that is still in use.

Remediation

The vulnerability has been addressed by changing the validity marking mechanism to use an explicit valid field, which is stored atomically and can be properly synchronized. Users should upgrade to the latest version of the Linux kernel where this fix has been applied.