CVE-2024-44991 tcp: prevent concurrent execution of tcp_sk_exit_batch

2024-09-0419:54:38

Linux

www.cve.org

linux kernel

vulnerability

tcp

concurrent execution

prevention

EPSS

Percentile

16.3%

JSON

In the Linux kernel, the following vulnerability has been resolved:

tcp: prevent concurrent execution of tcp_sk_exit_batch

Its possible that two threads call tcp_sk_exit_batch() concurrently,
once from the cleanup_net workqueue, once from a task that failed to clone
a new netns. In the latter case, error unwinding calls the exit handlers
in reverse order for the ‘failed’ netns.

tcp_sk_exit_batch() calls tcp_twsk_purge().
Problem is that since commit b099ce2602d8 (“net: Batch inet_twsk_purge”),
this function picks up twsk in any dying netns, not just the one passed
in via exit_batch list.

This means that the error unwind of setup_net() can “steal” and destroy
timewait sockets belonging to the exiting netns.

This allows the netns exit worker to proceed to call

WARN_ON_ONCE(!refcount_dec_and_test(&net->ipv4.tcp_death_row.tw_refcount));

without the expected 1 -> 0 transition, which then splats.

At same time, error unwind path that is also running inet_twsk_purge()
will splat as well:

WARNING: … at lib/refcount.c:31 refcount_warn_saturate+0x1ed/0x210
…
refcount_dec include/linux/refcount.h:351 [inline]
inet_twsk_kill+0x758/0x9c0 net/ipv4/inet_timewait_sock.c:70
inet_twsk_deschedule_put net/ipv4/inet_timewait_sock.c:221
inet_twsk_purge+0x725/0x890 net/ipv4/inet_timewait_sock.c:304
tcp_sk_exit_batch+0x1c/0x170 net/ipv4/tcp_ipv4.c:3522
ops_exit_list+0x128/0x180 net/core/net_namespace.c:178
setup_net+0x714/0xb40 net/core/net_namespace.c:375
copy_net_ns+0x2f0/0x670 net/core/net_namespace.c:508
create_new_namespaces+0x3ea/0xb10 kernel/nsproxy.c:110

… because refcount_dec() of tw_refcount unexpectedly dropped to 0.

This doesn’t seem like an actual bug (no tw sockets got lost and I don’t
see a use-after-free) but as erroneous trigger of debug check.

Add a mutex to force strict ordering: the task that calls tcp_twsk_purge()
blocks other task from doing final _dec_and_test before mutex-owner has
removed all tw sockets of dying netns.

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/ipv4/tcp_ipv4.c"
    ],
    "versions": [
      {
        "version": "e9bd0cca09d1",
        "lessThan": "e3d9de3742f4",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "e9bd0cca09d1",
        "lessThan": "99580ae890ec",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "e9bd0cca09d1",
        "lessThan": "f6fd2dbf584a",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "e9bd0cca09d1",
        "lessThan": "565d121b6998",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "net/ipv4/tcp_ipv4.c"
    ],
    "versions": [
      {
        "version": "6.1",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "6.1",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.1.107",
        "lessThanOrEqual": "6.1.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.48",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10.7",
        "lessThanOrEqual": "6.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.11",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]