CVE-2024-35910

2024-05-1909:15:11

416baaa9-dc9f-4396-8d5f-8c081fb06d67

web.nvd.nist.gov

linux kernel

tcp sockets

vulnerability

timers

netns

patch

kernel sockets

netns exit

refcount

rds

smc

mptcp

check_net

tcp_out_of_resources

nvd

6.5 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

13.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:

tcp: properly terminate timers for kernel sockets

We had various syzbot reports about tcp timers firing after
the corresponding netns has been dismantled.

Fortunately Josef Bacik could trigger the issue more often,
and could test a patch I wrote two years ago.

When TCP sockets are closed, we call inet_csk_clear_xmit_timers()
to ‘stop’ the timers.

inet_csk_clear_xmit_timers() can be called from any context,
including when socket lock is held.
This is the reason it uses sk_stop_timer(), aka del_timer().
This means that ongoing timers might finish much later.

For user sockets, this is fine because each running timer
holds a reference on the socket, and the user socket holds
a reference on the netns.

For kernel sockets, we risk that the netns is freed before
timer can complete, because kernel sockets do not hold
reference on the netns.

This patch adds inet_csk_clear_xmit_timers_sync() function
that using sk_stop_timer_sync() to make sure all timers
are terminated before the kernel socket is released.
Modules using kernel sockets close them in their netns exit()
handler.

Also add sock_not_owned_by_me() helper to get LOCKDEP
support : inet_csk_clear_xmit_timers_sync() must not be called
while socket lock is held.

It is very possible we can revert in the future commit
3a58f13a881e (“net: rds: acquire refcount on TCP sockets”)
which attempted to solve the issue in rds only.
(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)

We probably can remove the check_net() tests from
tcp_out_of_resources() and __tcp_close() in the future.

Affected configurations

Vulners

Node

linuxlinux_kernelRange4.2–4.19.312

linuxlinux_kernelRange4.20.0–5.4.274

linuxlinux_kernelRange5.5.0–5.10.215

linuxlinux_kernelRange5.11.0–5.15.154

linuxlinux_kernelRange5.16.0–6.1.85

linuxlinux_kernelRange6.2.0–6.6.26

linuxlinux_kernelRange6.7.0–6.8.5

linuxlinux_kernelRange6.9.0≥

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "include/net/inet_connection_sock.h",
      "include/net/sock.h",
      "net/ipv4/inet_connection_sock.c",
      "net/ipv4/tcp.c"
    ],
    "versions": [
      {
        "version": "8a68173691f0",
        "lessThan": "93f0133b9d58",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a68173691f0",
        "lessThan": "44e62f5d3567",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a68173691f0",
        "lessThan": "e3e27d2b446d",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a68173691f0",
        "lessThan": "2e43d8eba6ed",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a68173691f0",
        "lessThan": "91b243de910a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a68173691f0",
        "lessThan": "c1ae4d1e76ea",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a68173691f0",
        "lessThan": "899265c1389f",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "8a68173691f0",
        "lessThan": "151c9c724d05",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "include/net/inet_connection_sock.h",
      "include/net/sock.h",
      "net/ipv4/inet_connection_sock.c",
      "net/ipv4/tcp.c"
    ],
    "versions": [
      {
        "version": "4.2",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "4.2",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "4.19.312",
        "lessThanOrEqual": "4.19.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.4.274",
        "lessThanOrEqual": "5.4.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.10.215",
        "lessThanOrEqual": "5.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "5.15.154",
        "lessThanOrEqual": "5.15.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.85",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.26",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.8.5",
        "lessThanOrEqual": "6.8.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.9",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]