A proof-of-concept (PoC) exploit has been publicly released for a use-after-free vulnerability in the Linux kernel’s bridge subsystem, specifically within its Spanning Tree Protocol (STP) implementation. This flaw can result in STP timers remaining active after the associated bridge network device has been deleted, leading to potential memory safety issues.
The vulnerability arises when the kernel’s STP is enabled on a bridge that is administratively down, and a bridge port transitions to the LEARNING state. In this scenario, the kernel may activate periodic STP timers without verifying the interface’s IFF_UP flag. These timers are integral to the STP state machine, which manages bridge-port states and network topology changes to prevent Layer 2 loops.
Within the Linux kernel, timers such as hello_timer, tcn_timer, topology_change_timer, and port-specific timers are stored in the struct net_bridge. This structure resides in the private data area of the bridge’s net_device. Consequently, it’s crucial to remove these timers before releasing the associated network device. If the timers remain queued after the memory is freed, the kernel might attempt to execute a timer callback through a stale memory reference, leading to a use-after-free condition.
The root cause of this issue lies in the differing cleanup behaviors between a standard interface shutdown and direct bridge deletion. During a typical UP-to-DOWN transition, the ndo_stop path invokes br_stp_disable_bridge(), which synchronously cancels STP timers using del_timer_sync(), thereby preventing pending callbacks from accessing released bridge data. However, when a bridge is deleted via the delink path, br_dev_delete() is called without triggering the same STP cleanup routine. If the interface is already down, the device-unregistration process may also bypass ndo_stop. This oversight leaves armed timers attached to a per-CPU timer base, even though the associated net_device has been freed. Consequently, when the kernel’s timer processing routine later handles the dangling timer in softirq context, it may dereference freed memory.
Security researchers have noted that by controlling the reallocation of the released slab object, this vulnerability could potentially be exploited beyond causing a crash or denial-of-service, possibly leading to control-flow hijacking.
A patch addressing this issue has been introduced in Linux kernel commit 2a00517db8de4be7df3d483b215c5544fb30a191. Systems running kernel versions prior to this commit are considered vulnerable and should be updated using their distribution’s supported kernel packages. Until patched kernels are deployed, administrators are advised to restrict untrusted users from creating, modifying, or removing bridge interfaces and to review workloads that utilize kernel STP.
This development underscores the importance of diligent system maintenance and timely application of security patches. As vulnerabilities in critical subsystems like the Linux kernel’s bridge component can have far-reaching implications, staying informed and proactive is essential for maintaining system integrity and security.
