Intel ice driver UAF in dynamic port cleanup (drivers/net/ethernet/intel/ice/devlink.c)

脆弱性概要 この脆弱性は、 ドライバーが動的ポートのクリーンアップ処理において、VLAN からの動的ポートのエントリを削除するために を使用していることに関連しています。しかし、 を読み込んで削除処理を行う前に、その が解放されてしまい、use-after-free 問題を引き起こしています。 影響範囲 ファイル: 関数: 修正方法 修正方法は、配列エントリの削除を の解放よりも前に実行するように、割り当て順序を反転させることです。 POC コードまたはエクスプロイトコード ページには具体的な POC コードやエクスプロイトコードは含まれていませんが、修正パッチの diff 内容が提供されています： ```diff diff --git a/drivers/net/ethernet/intel/ice/devlink.c b/drivers/net/ethernet/intel/ice/devlink.c index 40935047e24a..306d24690727 100644 --- a/drivers/net/ethernet/intel/ice/devlink.c +++ b/drivers/net/ethernet/intel/ice/devlink.c @@ -530,8 +530,8 @@ static void ice_devlink_dynamic_port(struct ice_dynamic_port *dyn_port) { u16 eswitch_devs; if (eswitch_devs) ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->napi_ctx, eswitch_devs); ice_eswitch_detach_sfp(dyn_port->na

目標達成すべての支援者に感謝 — 100%達成しました！

Intel ice driver UAF in dynamic port cleanup (drivers/net/ethernet/intel/ice/devlink.c)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Intel ice driver UAF in dynamic port cleanup (drivers/net/ethernet/intel/ice/devlink.c)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！