Description
In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod_timer() in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls mod_timer() before taking the reference needed by the rearmed timer without holding the sock lock. This creates a race with timer cleanup: if the timer is deleted after mod_timer() returns but before the reference is taken, the cleanup path can drop the timer's reference and destroy the transport or association. The timer handler then takes a reference on the already freed object and eventually drops it, causing a refcount underflow. Hold the object before mod_timer() and drop the reference if mod_timer() reports that the timer was already pending in timer handlers. Apply the same ordering to the proto-unreachable path, which can rearm a transport timer outside the timer handlers without holding the sock lock.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f7dea7eaea20fe9b80f8f77ba44d02b4a17f8050affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f9d929026d487a988bfa12c065f892e823e5b6abaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 9d3d39da054476e7aa05cd877b93ca73a9a77434affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 27c51a9b55b227309161c903f9ecfbf022516bc2affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < d18cb8fd1b6ba95c85de644203cfe1b071ff0c0faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 35bf3b23c9a871f44c1453d85f8332be4e088ddaaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < cae23ae3f7887a1cf8a75da38edcebeef695040faffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f7dea7eaea20fe9b80f8f77ba44d02b4a17f8050 ↗
- https://git.kernel.org/stable/c/f9d929026d487a988bfa12c065f892e823e5b6ab ↗
- https://git.kernel.org/stable/c/9d3d39da054476e7aa05cd877b93ca73a9a77434 ↗
- https://git.kernel.org/stable/c/27c51a9b55b227309161c903f9ecfbf022516bc2 ↗
- https://git.kernel.org/stable/c/d18cb8fd1b6ba95c85de644203cfe1b071ff0c0f ↗
- https://git.kernel.org/stable/c/35bf3b23c9a871f44c1453d85f8332be4e088dda ↗
- https://git.kernel.org/stable/c/cae23ae3f7887a1cf8a75da38edcebeef695040f ↗