CVE-2024-44996 vsock: fix recursive ->recvmsg calls

2024-09-0419:54:41

Linux

www.cve.org

vsock

vulnerability

linux

kernel

fix

recursion

recvmsg

bpf

sockmap

EPSS

Percentile

5.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:

vsock: fix recursive ->recvmsg calls

After a vsock socket has been added to a BPF sockmap, its prot->recvmsg
has been replaced with vsock_bpf_recvmsg(). Thus the following
recursiion could happen:

vsock_bpf_recvmsg()
-> __vsock_recvmsg()
-> vsock_connectible_recvmsg()
-> prot->recvmsg()
-> vsock_bpf_recvmsg() again

We need to fix it by calling the original ->recvmsg() without any BPF
sockmap logic in __vsock_recvmsg().

CNA Affected

[
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "unaffected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "include/net/af_vsock.h",
      "net/vmw_vsock/af_vsock.c",
      "net/vmw_vsock/vsock_bpf.c"
    ],
    "versions": [
      {
        "version": "634f1a7110b4",
        "lessThan": "921f1acf0c3c",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "634f1a7110b4",
        "lessThan": "b4ee8cf1acc5",
        "status": "affected",
        "versionType": "git"
      },
      {
        "version": "634f1a7110b4",
        "lessThan": "69139d2919dd",
        "status": "affected",
        "versionType": "git"
      }
    ]
  },
  {
    "product": "Linux",
    "vendor": "Linux",
    "defaultStatus": "affected",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "programFiles": [
      "include/net/af_vsock.h",
      "net/vmw_vsock/af_vsock.c",
      "net/vmw_vsock/vsock_bpf.c"
    ],
    "versions": [
      {
        "version": "6.4",
        "status": "affected"
      },
      {
        "version": "0",
        "lessThan": "6.4",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.6.48",
        "lessThanOrEqual": "6.6.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.10.7",
        "lessThanOrEqual": "6.10.*",
        "status": "unaffected",
        "versionType": "custom"
      },
      {
        "version": "6.11",
        "lessThanOrEqual": "*",
        "status": "unaffected",
        "versionType": "original_commit_for_fix"
      }
    ]
  }
]