Public PoC Released for Linux Kernel Bridge Use-After-Free Vulnerability

A public proof-of-concept has been released for a use-after-free flaw affecting the Linux kernel’s bridge subsystem, specifically its Spanning Tree Protocol implementation in net/bridge. The issue can leave STP timers active after the bridge network device that owns them has been deleted, creating a dangerous memory-safety condition in the kmalloc-cg-8k slab cache. The use-after-free vulnerability occurs when kernel STP is enabled on an administratively down bridge and a bridge port transitions to the LEARNING state. In this condition, the kernel can arm periodic STP timers without checking the IFF_UP interface flag. These timers support the STP state machine, which prevents Layer 2 loops by managing bridge-port states and...

Read the full article at the source.