جزئیات آسیب‌پذیری

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

In the Linux kernel, the following vulnerability has been resolved: io_uring/napi: make stale entries time out after 60s With dynamic tracking a NAPI id that hasn't been seen for a minute is meant to be dropped from the list the ring busy polls. The timeout is added to jiffies, but it is defined as 60 * SEC_CONVERSION, and SEC_CONVERSION isn't the number of jiffies in a second. It is the internal factor of __timespec64_to_jiffies(), HZ scaled up by SEC_JIFFIE_SC bits. For HZ=1000 that is 1000 << 22, which puts the timeout at about eight years. On 32-bit the multiplication overflows. So entries are never removed, and every id that a socket of the ring ever had keeps being polled on each wait.

• https://git.kernel.org/stable/c/3fe820cf35f83534eab72ea73f1a83cfd3cd8079
• https://git.kernel.org/stable/c/18c373f446068972788158c8c7de6e849b04ed98
• https://git.kernel.org/stable/c/981621d6eadcd232d4ea748aaeb046337f10d3c1
• https://git.kernel.org/stable/c/9c151648780d89e5446e5f89f3fa2e416c3bb911