Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2024-50186

net: explicitly clear the sk pointer, when pf->create fails

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: explicitly clear the sk pointer, when pf->create fails We have recently noticed the exact same KASAN splat as in commit 6cd4a78d962b ("net: do not leave a dangling sk pointer, when socket creation fails"). The problem is that commit did not fully address the problem, as some pf->create implementations do not use sk_common_release in their error paths. For example, we can use the same reproducer as in the above commit, but changing ping to arping. arping uses AF_PACKET socket and if packet_create fails, it will just sk_free the allocated sk object. While we could chase all the pf->create implementations and make sure they NULL the freed sk object on error from the socket, we can't guarantee future protocols will not make the same mistake. So it is easier to just explicitly NULL the sk pointer upon return from pf->create in __sock_create. We do know that pf->create always releases the allocated sk object on error, so if the pointer is not NULL, it is definitely dangling.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 78e4aa528a7b1204219d808310524344f627d069 to < daf462ff3cde6ecf22b98d9ae770232c10d28de2affected
  • 893eeba94c40d513cd0fe6539330ebdaea208c0e to < b7d22a79ff4e962b8af5ffe623abd1d6c179eb9faffected
  • 454c454ed645fed051216b79622f7cb69c1638f5 to < 563e6892e21d6ecabdf62103fc4e7b326d212334affected
  • 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 to < 8e1b72fd74bf9da3b099d09857f4e7f114f38e12affected
  • 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 to < 631083143315d1b192bd7d915b967b37819e88eaaffected
  • 5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9affected
  • 5.15.162 to < 5.15.168affected
  • 6.1.96 to < 6.1.113affected
  • 6.6.36 to < 6.6.57affected
  • 6.9.7 to < 6.10affected

Linux Linux

Default version status: affected

  • 6.10affected
  • 0 to < 6.10unaffected
  • 5.15.168 to ≤ 5.15.*unaffected
  • 6.1.113 to ≤ 6.1.*unaffected
  • 6.6.57 to ≤ 6.6.*unaffected
  • 6.11.4 to ≤ 6.11.*unaffected
  • 6.12 to ≤ *unaffected

References