In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: clear sock_ops cb flags before force-closing a child socket<\/p>\n
A child socket inherits the listener’s bpf_sock_ops_cb_flags via
\nsk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() \/
\ntcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where
\ninet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs
\nwithout it.<\/p>\n
If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state()
\ncalls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me():<\/p>\n
WARNING: include\/net\/sock.h:1799 at tcp_set_state+0x433\/0x550
\n RIP: 0010:tcp_set_state+0x433\/0x550 include\/net\/sock.h:1799
\n Call Trace:<\/p>\n
tcp_done+0xba\/0x250 net\/ipv4\/tcp.c:5095
\n tcp_v4_syn_recv_sock+0x850\/0xa50 net\/ipv4\/tcp_ipv4.c:1787
\n tcp_check_req+0xf30\/0x1360 net\/ipv4\/tcp_minisocks.c:926
\n tcp_v4_rcv+0x1047\/0x1b50 net\/ipv4\/tcp_ipv4.c:2164<\/p>\n
The child is freed before it is ever established, so it should run no
\nsock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(),
\nthe common point for the IPv4, IPv6 and chtls forced-close paths and for the
\nMPTCP ->syn_recv_sock() failure path (dispose_child), which reaches tcp_done()
\non a child that was never established too.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tcp: clear sock_ops cb flags before force-closing a child socket<\/p>\n
A child socket inherits the listener’s bpf_sock_ops_cb_flags via<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7202","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7202","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7202"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7202"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7202"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}