In the Linux kernel, the following vulnerability has been resolved: net/sched: act_mirred: don't override retval if we already lost the skb If we're redirecting the skb, and haven't called tcf_mirred_forward(), yet, we need to tell the core to drop the skb by setting the retcode to SHOT. If we have called tcf_mirred_forward(), however, the skb is out of our hands and returning SHOT will lead to UaF. Move the retval override to the error path which actually need it.
| Product | Vendor | Version |
|---|---|---|
| Linux | Linux | Snapdragon 778G+ 5G Mobile Platform (SM7325-AE) |
| Linux | Linux | < 447c19f3b5074409c794b350b10306e1da1ef4ba |
| Linux | Linux | <= 3.3.2 |