A recently published proof-of-concept has revealed a use-after-free vulnerability within the Linux kernel’s bridge subsystem. This flaw is specifically linked to the implementation of the Spanning Tree Protocol (STP) in the net/bridge component.
Understanding the Vulnerability
The vulnerability arises when STP timers remain active even after the bridge network device managing them is deleted, posing a threat to memory safety within the kmalloc-cg-8k slab cache. This issue is particularly evident when the kernel STP is activated on a bridge in an administratively down state, and a bridge port shifts to the LEARNING state.
In such scenarios, the kernel may activate periodic STP timers without verifying the IFF_UP interface flag. These timers are crucial for the STP state machine, which manages bridge-port states and adapts to network topology changes to prevent Layer 2 loops.
Technical Details and Risks
Linux utilizes a struct net_bridge to store timers like hello_timer, tcn_timer, topology_change_timer, and port-specific timers, located within the private data area of the bridge’s net_device. It is essential to remove these timers before the associated network device is released. Failure to do so may lead to the kernel executing a timer callback from an obsolete memory reference.
According to SSD Disclosure, a discrepancy in cleanup behavior between normal interface shutdown and direct bridge deletion triggers this bug. During a typical UP-to-DOWN transition, the ndo_stop path initiates br_stp_disable_bridge(), which cancels STP timers using del_timer_sync(). This process prevents potential callbacks from accessing released bridge data.
Preventive Measures and Patch Availability
However, removing a bridge via the delink path calls br_dev_delete() but does not engage the same STP cleanup process. If the interface is already down, the device-unregistration might bypass ndo_stop, leaving timers attached to a per-CPU timer base while the net_device is freed. Subsequent kernel timer processing could access this freed memory, risking a crash or denial-of-service scenario.
Researchers indicated that controlled reallocation of the released slab object might allow the bug to serve as a control-flow hijacking primitive, potentially escalating its impact. A public PoC emphasizes the critical need for prompt remediation, especially in environments permitting bridge configuration alterations.
A Linux kernel patch has been introduced in commit 2a00517db8de4be7df3d483b215c5544fb30a191. Systems with kernels predating this change should be updated through supported distribution kernel packages. Until these patches are applied, administrators are advised to limit untrusted user access to bridge interfaces and evaluate workloads using kernel STP.
