Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb: BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587) Sync the hint to the copy.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c31b70c9968fe9c4194d1b5d06d07596a3b680de to < fad6d429651e748365e93ca54645accc212f0018affectedc31b70c9968fe9c4194d1b5d06d07596a3b680de to < c5b4da1f403a658c1c19766be2b426003ada419faffectedc31b70c9968fe9c4194d1b5d06d07596a3b680de to < 71d45049b0d631dfdbf3c65305f7fca676de023baffectedc31b70c9968fe9c4194d1b5d06d07596a3b680de to < e3ea71cb1408a013ed4e8a757b815f1a919324bdaffectedc31b70c9968fe9c4194d1b5d06d07596a3b680de to < 631aa4cb45099f09e9385dd786bd291c6270bfc4affectedc31b70c9968fe9c4194d1b5d06d07596a3b680de to < 0f87720c7e4bcab07c24888b3cf12bfe857bb90eaffectedc31b70c9968fe9c4194d1b5d06d07596a3b680de to < fe99bbeee5c5dbd3abc30721a8079ced59649d97affected
Linux Linux
Default version status: affected
5.11affected0 to < 5.11unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018 ↗
- https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f ↗
- https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b ↗
- https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd ↗
- https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4 ↗
- https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e ↗
- https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97 ↗