In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()<\/p>\n
When tipc_sk_create() fails to insert the new socket (tipc_sk_insert()
\nreturns non-zero), its error path frees the sk with sk_free() but leaves
\nsock->sk pointing at the freed object:<\/p>\n
\tif (tipc_sk_insert(tsk)) {
\n\t\tsk_free(sk);
\n\t\tpr_warn(“Socket create failed; port number exhaustedn”);
\n\t\treturn -EINVAL;
\n\t}<\/p>\n
This is harmless for plain socket(): the syscall layer clears sock->ops
\nbefore releasing, so tipc_release() is never called. It is not harmless
\non the accept() path. tipc_accept() creates the pre-allocated child
\nsocket with tipc_sk_create(net, new_sock, 0, kern); on failure it leaves
\nnew_sock->sk dangling and new_sock->ops non-NULL, and do_accept() then
\nfput()s the new file, so __sock_release() -> tipc_release() runs
\nlock_sock(new_sock->sk) on the freed sk — a use-after-free write of the
\nsk_lock spinlock.<\/p>\n
tipc_release() already guards this exact “failed accept() releases a
\npre-allocated child” case with “if (sk == NULL) return 0;”, but the
\nguard is bypassed because tipc_sk_create() left sock->sk non-NULL
\n(dangling) rather than NULL.<\/p>\n
Clear sock->sk on the failed-insert path so the existing tipc_release()
\nNULL check fires and the use-after-free is avoided.<\/p>\n
The tipc_sk_insert() failure is reached when the per-netns socket
\nrhashtable hits its max_size (tsk_rht_params.max_size = 1048576, ~2M
\nelements) — i.e. once a netns holds ~2M TIPC sockets every insert
\nreturns -E2BIG.<\/p>\n
BUG: KASAN: slab-use-after-free in lock_sock_nested (net\/core\/sock.c:3839)
\n Write of size 8 at addr ffff8880047cdc38 by task init\/1
\n lock_sock_nested (net\/core\/sock.c:3839)
\n tipc_release (net\/tipc\/socket.c:638)
\n __sock_release (net\/socket.c:710)
\n sock_close (net\/socket.c:1501)
\n __fput (fs\/file_table.c:512)
\n Allocated by task 1:
\n sk_alloc (net\/core\/sock.c:2308)
\n tipc_sk_create (net\/tipc\/socket.c:487)
\n tipc_accept (net\/tipc\/socket.c:2744)
\n do_accept (net\/socket.c:2034)
\n Freed by task 1:
\n __sk_destruct (net\/core\/sock.c:2391)
\n tipc_sk_create (net\/tipc\/socket.c:504)
\n tipc_accept (net\/tipc\/socket.c:2744)
\n do_accept (net\/socket.c:2034)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tipc: clear sock->sk on the failed-insert path in tipc_sk_create()<\/p>\n
When tipc_sk_create() fails to insert the new socket (tipc_sk_i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5331","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5331","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5331"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5331"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5331"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}