Description
In the Linux kernel, the following vulnerability has been resolved: sctp: check RCV_SHUTDOWN after the sendmsg connect wait sctp_wait_for_connect() drops the socket lock while it sleeps. An out-of-the-blue ABORT can then be processed from the socket backlog and unlink the association. If a concurrent shutdown(fd, SHUT_RD) sets RCV_SHUTDOWN, the waiter breaks with err == 0 before checking asoc->base.dead. Its final sctp_association_put() can then free the association, leaving sctp_sendmsg_to_asoc() to continue with a dangling pointer. Check RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc() before using the association again. The check only accesses the socket, so it needs no additional association reference. Return the existing -ESRCH so that sctp_sendmsg() skips freeing a new association that may already have been destroyed. Keep sctp_wait_for_connect() unchanged to preserve its behavior for the connect() caller.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
668c9beb9020d5834ee9e43c208190a07d2b1928 to < 7f798168c54455559da0f7a377a23ab7019fec35affected668c9beb9020d5834ee9e43c208190a07d2b1928 to < fe5a23c76fc48b711eb7d6f3462c994e34da36f9affected668c9beb9020d5834ee9e43c208190a07d2b1928 to < 1e7cd89975fa3b11ebd7e1bbb4648a71c0e0e2d4affected668c9beb9020d5834ee9e43c208190a07d2b1928 to < 1bef1944ef15a40797305bf916827b04df6307caaffected668c9beb9020d5834ee9e43c208190a07d2b1928 to < e8f972b1759d26bbefe4c524caae1ed7c8a593bdaffected668c9beb9020d5834ee9e43c208190a07d2b1928 to < e701345d886e831fb593a0870d69c8c5de6fc938affected668c9beb9020d5834ee9e43c208190a07d2b1928 to < 222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669affected668c9beb9020d5834ee9e43c208190a07d2b1928 to < 4f1da630d13de0370e2f6361f961f1c8b384af1caffected
Linux Linux
Default version status: affected
4.16affected0 to < 4.16unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.113 to ≤ 6.12.*unaffected6.18.56 to ≤ 6.18.*unaffected7.2.10 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7f798168c54455559da0f7a377a23ab7019fec35 ↗
- https://git.kernel.org/stable/c/fe5a23c76fc48b711eb7d6f3462c994e34da36f9 ↗
- https://git.kernel.org/stable/c/1e7cd89975fa3b11ebd7e1bbb4648a71c0e0e2d4 ↗
- https://git.kernel.org/stable/c/1bef1944ef15a40797305bf916827b04df6307ca ↗
- https://git.kernel.org/stable/c/e8f972b1759d26bbefe4c524caae1ed7c8a593bd ↗
- https://git.kernel.org/stable/c/e701345d886e831fb593a0870d69c8c5de6fc938 ↗
- https://git.kernel.org/stable/c/222c41e0f50f1d5028be9baf0e1dcfc0bfa7f669 ↗
- https://git.kernel.org/stable/c/4f1da630d13de0370e2f6361f961f1c8b384af1c ↗