In the Linux kernel, the following vulnerability has been resolved:
udp: fix race between close() and udp_abort()
Kaustubh reported and diagnosed a panic in udp_lib_lookup().
The root cause is udp_abort() racing with close(). Both
racing functions acquire the socket lock, but udp{v6}_destroy_sock()
release it before performing destructive actions.
We can’t easily extend the socket lock scope to avoid the race,
instead use the SOCK_DEAD flag to prevent udp_abort from doing
any action when the critical race happens.
Diagnosed-and-tested-by: Kaustubh Pandey <[email protected]>
[
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/ipv4/udp.c",
"net/ipv6/udp.c"
],
"versions": [
{
"version": "5d77dca82839",
"lessThan": "e3c36c773aed",
"status": "affected",
"versionType": "git"
},
{
"version": "5d77dca82839",
"lessThan": "a0882f68f54f",
"status": "affected",
"versionType": "git"
},
{
"version": "5d77dca82839",
"lessThan": "2f73448041bd",
"status": "affected",
"versionType": "git"
},
{
"version": "5d77dca82839",
"lessThan": "5a88477c1c85",
"status": "affected",
"versionType": "git"
},
{
"version": "5d77dca82839",
"lessThan": "8729ec8a2238",
"status": "affected",
"versionType": "git"
},
{
"version": "5d77dca82839",
"lessThan": "65310b0aff86",
"status": "affected",
"versionType": "git"
},
{
"version": "5d77dca82839",
"lessThan": "a8b897c7bcd4",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"net/ipv4/udp.c",
"net/ipv6/udp.c"
],
"versions": [
{
"version": "4.9",
"status": "affected"
},
{
"version": "0",
"lessThan": "4.9",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "4.9.274",
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "4.14.238",
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "4.19.196",
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.4.128",
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.10.46",
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.12.13",
"lessThanOrEqual": "5.12.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.13",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
]
git.kernel.org/stable/c/2f73448041bd0682d4b552cfd314ace66107f1ad
git.kernel.org/stable/c/5a88477c1c85e4baa51e91f2d40f2166235daa56
git.kernel.org/stable/c/65310b0aff86980a011c7c7bfa487a333d4ca241
git.kernel.org/stable/c/8729ec8a2238152a4afc212a331a6cd2c61aeeac
git.kernel.org/stable/c/a0882f68f54f7a8b6308261acee9bd4faab5a69e
git.kernel.org/stable/c/a8b897c7bcd47f4147d066e22cc01d1026d7640e
git.kernel.org/stable/c/e3c36c773aed0fef8b1d3d555b43393ec564400f