Description
In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sock_gettstamp() sk->sk_flags must only be changed while holding the socket lock, because sock_set_flag() and sock_reset_flag() use non atomic operations (__set_bit() and __clear_bit()). sock_gettstamp() is one of the last places where a bit of sk->sk_flags is changed from a syscall without owning the socket lock, through sock_enable_timestamp(sk, SOCK_TIMESTAMP). sk_set_memalloc() and sk_clear_memalloc() also change sk->sk_flags without the socket lock, but their callers (nbd, iscsi_tcp, nvme-tcp, sunrpc, wireguard) need a careful audit, this will be addressed in a separate patch. Jungwoo Lee and Wongi Lee reported an UDP socket use-after-free caused by this bug: a SIOCGSTAMPNS_NEW ioctl racing with bind() can cancel the SOCK_RCU_FREE bit that udp_lib_get_port() just set, because both threads perform a read-modify-write on the same word. CPU 0 (bind) CPU 1 (SIOCGSTAMPNS_NEW) -------------------------------- ---------------------------- read sk_flags = F read sk_flags = F compute F | BIT(SOCK_RCU_FREE) compute F | BIT(SOCK_TIMESTAMP) store F | BIT(SOCK_RCU_FREE) sk_add_node_rcu(sk, ...) store F | BIT(SOCK_TIMESTAMP) After the lost update, SOCK_RCU_FREE is clear while the socket is visible to lockless UDP receive lookups. sk_destruct() then frees the socket immediately instead of waiting for a RCU grace period, while the receive path still holds a reference-less pointer to it: BUG: KASAN: slab-use-after-free in ipv4_pktinfo_prepare+0x30/0x410 Read of size 8 at addr ffff888008806610 by task exploit/207 CPU: 0 UID: 1000 PID: 207 Comm: exploit Not tainted 6.12.95+ #1 ipv4_pktinfo_prepare+0x30/0x410 udp_queue_rcv_one_skb+0x51c/0x1180 udp_unicast_rcv_skb+0x109/0x350 ip_protocol_deliver_rcu+0x14b/0x310 ip_local_deliver_finish+0x29d/0x390 ip_local_deliver+0x24d/0x2a0 Only grab the socket lock when SOCK_TIMESTAMP has to be set, to keep the common case lockless.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 18899e2e4023369a8f7739c2255a59a9748d8d17affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 88c804847dd87dc613b771b392ccecdb94725032affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3b12d3967e96f1b7b977d9fc352ae29a1b299a82affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 17b2a1eb97fdb2a2cbaeab3b146b26797ea9311faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 1f73253add8365d0dad0a4f421acaa8c21d20cefaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < d9f96bc2d822501f84d1caa6275a2c6b316ca2c4affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 899650bbf985b7bfd2a7b808357df9b16e6d6959affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9ed55f3dbef4f4adfe65eb03b0c35c53229a8490affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/18899e2e4023369a8f7739c2255a59a9748d8d17 ↗
- https://git.kernel.org/stable/c/88c804847dd87dc613b771b392ccecdb94725032 ↗
- https://git.kernel.org/stable/c/3b12d3967e96f1b7b977d9fc352ae29a1b299a82 ↗
- https://git.kernel.org/stable/c/17b2a1eb97fdb2a2cbaeab3b146b26797ea9311f ↗
- https://git.kernel.org/stable/c/1f73253add8365d0dad0a4f421acaa8c21d20cef ↗
- https://git.kernel.org/stable/c/d9f96bc2d822501f84d1caa6275a2c6b316ca2c4 ↗
- https://git.kernel.org/stable/c/899650bbf985b7bfd2a7b808357df9b16e6d6959 ↗
- https://git.kernel.org/stable/c/9ed55f3dbef4f4adfe65eb03b0c35c53229a8490 ↗