Linux Kernel Duplicate Leaf Handling Vulnerability in Net Shaper Group Request

A vulnerability in the Linux kernel's net shaper component allows for improper handling of duplicate leaf entries in group requests. This issue arises because the net_shaper_nl_group_doit() function fails to remove duplicates when userspace sends the same leaf handle more than once. As a result, the same parent pointer can be recorded multiple times, leading to a double free during cleanup. This vulnerability is present in the Linux kernel stable tree.

Impact

Exploitation of this vulnerability causes a double free error, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

To reproduce this vulnerability, send a GROUP request to the net shaper component with duplicate leaf handles. The net_shaper_nl_group_doit() function will process the request without deduplicating the leaves, causing the same parent pointer to be referenced multiple times. When the cleanup routine is executed, it will double free the parent pointer, leading to memory corruption.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.