In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: lock the socket in sock_gettstamp()<\/p>\n
sk->sk_flags must only be changed while holding the socket lock,
\nbecause sock_set_flag() and sock_reset_flag() use non atomic
\noperations (__set_bit() and __clear_bit()).<\/p>\n
sock_gettstamp() is one of the last places where a bit of sk->sk_flags
\nis changed from a syscall without owning the socket lock, through
\nsock_enable_timestamp(sk, SOCK_TIMESTAMP).<\/p>\n
sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags
\nwithout the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp,
\nsunrpc, wireguard) need a careful audit, this will be addressed in a
\nseparate patch.<\/p>\n
Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free
\ncaused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind()
\ncan cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set,
\nbecause both threads perform a read-modify-write on the same word.<\/p>\n
CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW)
\n ——————————– —————————-
\n read sk_flags = F read sk_flags = F
\n compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP)
\n store F | BIT(SOCK_RCU_FREE)
\n sk_add_node_rcu(sk, …)
\n store F | BIT(SOCK_TIMESTAMP)<\/p>\n
After the lost update, SOCK_RCU_FREE is clear while the socket is
\nvisible to lockless UDP receive lookups. sk_destruct() then frees
\nthe socket immediately instead of waiting for a RCU grace period,
\nwhile the receive path still holds a reference-less pointer to it:<\/p>\n
BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30\/0x410
\n Read of size 8 at addr ffff888008806610 by task exploit\/207
\n CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1
\n ipv4_pktinfo_prepare+0x30\/0x410
\n udp_queue_rcv_one_skb+0x51c\/0x1180
\n udp_unicast_rcv_skb+0x109\/0x350
\n ip_protocol_deliver_rcu+0x14b\/0x310
\n ip_local_deliver_finish+0x29d\/0x390
\n ip_local_deliver+0x24d\/0x2a0<\/p>\n
Only grab the socket lock when SOCK_TIMESTAMP has to be set,
\nto keep the common case lockless.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: lock the socket in sock_gettstamp()<\/p>\n
sk->sk_flags must only be changed while holding the socket lock,
\nbecause sock_set_flag() <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33345","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33345","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}