Description
In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking. Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock. This keeps the VFS data stable while the reply is being built.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5f7b0569460b7d8d01ca776430a00505a68b7584 to < e7339db13b9ddb63417b12da55fd6191e59f7442affected5f7b0569460b7d8d01ca776430a00505a68b7584 to < 4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7affected5f7b0569460b7d8d01ca776430a00505a68b7584 to < c3ec44ab4526bbc4b6c9fc845af86488244f4c9baffected5f7b0569460b7d8d01ca776430a00505a68b7584 to < b9232421a77a649c9376c99fdfc8cb7f79cad34caffected5f7b0569460b7d8d01ca776430a00505a68b7584 to < 0c739f3785f84af695952c2bac8be2f45082c9b8affected5f7b0569460b7d8d01ca776430a00505a68b7584 to < 900a4e0910e98b8caef117d5df00471fa438dcf9affected5f7b0569460b7d8d01ca776430a00505a68b7584 to < bdf206e740bf2919d818f132c8c9cc7ed91d11c0affected5f7b0569460b7d8d01ca776430a00505a68b7584 to < 39897df386376912d561d4946499379effa1e7efaffected
Linux Linux
Default version status: affected
3.3affected0 to < 3.3unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.136 to ≤ 6.6.*unaffected6.12.83 to ≤ 6.12.*unaffected6.18.24 to ≤ 6.18.*unaffected6.19.14 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442 ↗
- https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7 ↗
- https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b ↗
- https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c ↗
- https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8 ↗
- https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9 ↗
- https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0 ↗
- https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗