Linux Kernel Bridge Per-VLAN Multicast Snooping Use-After-Free Vulnerability

A use-after-free vulnerability has been identified in the Linux kernel's bridge networking component, specifically related to multicast snooping. When per-VLAN multicast snooping is enabled, the bridge can inadvertently leave a per-port multicast context active on a port that has been removed, leading to a use-after-free condition. This issue arises because the current implementation does not properly disable the per-port context when both per-VLAN and global multicast snooping are active on the same port. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can lead to a use-after-free condition, where a freed memory object is accessed, potentially causing memory corruption or allowing an attacker to execute arbitrary code.

Reproduction

To reproduce this vulnerability, create a bridge interface with global multicast snooping enabled. Then, add a dummy interface as a port to the bridge. After that, enable per-VLAN multicast snooping on the bridge while disabling global snooping. Finally, remove the port from the bridge. This sequence of actions will result in the per-port multicast context remaining active when the port is freed, creating a use-after-free situation.

Remediation

The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version.