batadv_tp_sender counter underflow in Linux kernel

Executive Summary

This vulnerability exists in the Linux kernel's batman-adv component, specifically in the tp_meter counter during shutdown. The function batadv_tp_sender_shutdown() decreases an atomic counter called "sending" unconditionally. If this function is called multiple times from different paths (such as timeout, user cancel, or normal finish), the counter can underflow to -1.

Because the sender logic treats any non-zero value as "still sending," a negative value causes the sender kernel thread to loop indefinitely. This results in a use-after-free condition when the network interface is removed while this zombie thread is still active.

The fix involves using atomic_xchg() to ensure the counter only transitions from 1 to 0 once, preventing the underflow.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a kernel thread to loop indefinitely, leading to a use-after-free condition in the Linux kernel's batman-adv networking component.

Such a use-after-free can potentially cause system instability, crashes, or unpredictable behavior when the affected network interface is removed while the zombie thread is still active.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by updating the Linux kernel to a version where the batman-adv tp_meter counter underflow issue is resolved.

Specifically, the fix involves correcting the batadv_tp_sender_shutdown() function to prevent the atomic counter from underflowing, which avoids the sender kthread looping indefinitely and causing a use-after-free.

• Update your Linux kernel to the latest version that includes this fix.
• Avoid removing interfaces while the sender thread is active until the fix is applied.

Useful 0 Not Useful 0