Description
In the Linux kernel, the following vulnerability has been resolved: sctp: hold socket lock when dumping endpoints in sctp_diag SCTP_DIAG endpoint dumping was traversing endpoint address lists without holding lock_sock(), while those lists could change concurrently via socket operations (e.g., bindx changes). This creates a race where nla_reserve() counts addresses under RCU protection, but the subsequent copy may see fewer entries, potentially leaking uninitialized memory to userspace. Fix this by: - Taking a reference on each endpoint during hash traversal - Moving socket operations (lock_sock()) outside read_lock_bh() - Serializing address list access during dump - Reworking sctp_for_each_endpoint() to support restart-based traversal with (net, pos) tracking Also: - Add WARN_ON_ONCE() for inconsistent address counts - Fix idiag_states filtering for LISTEN vs association cases - Skip dumping endpoints being freed (ep->base.dead) - Move dump position tracking into iterator, removing cb->args[4] and its comment for sctp_ep_dump()., - Update the comment for cb->args[4] and remove the comment for unused cb->args[5] for sctp_sock_dump(). Note: traversal is restart-based and may re-scan buckets multiple times, but this is acceptable due to small bucket sizes and required to support sleeping-safe callbacks. This issue was reported by Nico Yip (@_cyeaa_) working with TrendAI Zero Day Initiative.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8f840e47f190cbe61a96945c13e9551048d42cef to < f98c294a9369b6fe89e652c06357ee594be4dfa2affected8f840e47f190cbe61a96945c13e9551048d42cef to < 8b38e3dcfde3077dbc03eb8ef88e03cc19f70b8aaffected8f840e47f190cbe61a96945c13e9551048d42cef to < ec3c2d59a192e17e1014ba71afc368ba162ecac3affected8f840e47f190cbe61a96945c13e9551048d42cef to < 722576aba0a6d9423714550b1c03239b0f0def77affected8f840e47f190cbe61a96945c13e9551048d42cef to < abe7f8828e6ac8be858870c2bf836258844f97d5affected8f840e47f190cbe61a96945c13e9551048d42cef to < 207bb4ce8fe7de961ae7bb33569ad2cd61f44954affected8f840e47f190cbe61a96945c13e9551048d42cef to < f09a245f33e567b604efa1960b7a2d25dd9c8713affected8f840e47f190cbe61a96945c13e9551048d42cef to < 7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823affected
Linux Linux
Default version status: affected
4.7affected0 to < 4.7unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f98c294a9369b6fe89e652c06357ee594be4dfa2 ↗
- https://git.kernel.org/stable/c/8b38e3dcfde3077dbc03eb8ef88e03cc19f70b8a ↗
- https://git.kernel.org/stable/c/ec3c2d59a192e17e1014ba71afc368ba162ecac3 ↗
- https://git.kernel.org/stable/c/722576aba0a6d9423714550b1c03239b0f0def77 ↗
- https://git.kernel.org/stable/c/abe7f8828e6ac8be858870c2bf836258844f97d5 ↗
- https://git.kernel.org/stable/c/207bb4ce8fe7de961ae7bb33569ad2cd61f44954 ↗
- https://git.kernel.org/stable/c/f09a245f33e567b604efa1960b7a2d25dd9c8713 ↗
- https://git.kernel.org/stable/c/7d8297e26b4e20b5d1c3c3fe51fe81a1c7fbc823 ↗