Linux Kernel OpenVPN Race Condition Vulnerability in Peer Management

A race condition vulnerability has been identified in the OpenVPN implementation within the Linux kernel. This issue arises when deleting an OpenVPN interface, creating a narrow window where adding a new peer via netlink can cause the network device to hang, preventing its proper unregistration. The problem occurs during the interface deletion process, when existing peers are cleared and the device is queued for deregistration. If a 'CMD_PEER_NEW' message arrives during this time, it can reintroduce a reference to the net device, leading to a situation where the device cannot be released, as it is assumed all peers have been freed. The vulnerability affects the Linux kernel's stable branch, specifically within the OpenVPN netlink interface management.

Impact

Exploitation of this vulnerability can cause a network device to become unresponsive and fail to unregister properly, potentially leading to resource leaks or degraded system performance.

Reproduction

To reproduce this vulnerability, delete an OpenVPN interface while simultaneously adding a new peer through netlink. This can be done by sending a 'CMD_PEER_NEW' message after the interface has been queued for deregistration but before it has been fully unregistered. The race condition will cause the net device to hang, preventing its proper unregistration.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.