CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
5.1%
In the Linux kernel, the following vulnerability has been resolved: bpf,
skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix
NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot
reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop /
sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task
10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline]
sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put
include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260
net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048
__sock_release net/socket.c:659 [inline] sock_close+0x68/0x150
net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422
__fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556
[inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541
__x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0
entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff88814b3278b8 of 8
bytes by task 10713 on cpu 0: sk_psock_data_ready include/linux/skmsg.h:464
[inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555
sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606
sk_psock_verdict_apply net/core/skmsg.c:1008 [inline]
sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb
net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0
net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220
net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860
net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410
net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg
net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0
entry_SYSCALL_64_after_hwframe+0x6d/0x75 value changed: 0xffffffff83d7feb0
-> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0
PID: 10713 Comm: syz-executor.4 Tainted: G W
6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute
Engine/Google Compute Engine, BIOS Google 02/29/2024 Prior to this, commit
4cd12c6065df (“bpf, sockmap: Fix NULL pointer dereference in
sk_psock_verdict_data_ready()”) fixed one NULL pointer similarly due to no
protection of saved_data_ready. Here is another different caller causing
the same issue because of the same reason. So we should protect it with
sk_callback_lock read lock because the writer side in the sk_psock_drop()
uses “write_lock_bh(&sk->sk_callback_lock);”. To avoid errors that could
happen in future, I move those two pairs of lock into the
sk_psock_data_ready(), which is suggested by John Fastabend.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 20.04 | noarch | linux | < any | UNKNOWN |
ubuntu | 22.04 | noarch | linux | < any | UNKNOWN |
ubuntu | 24.04 | noarch | linux | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws | < any | UNKNOWN |
ubuntu | 22.04 | noarch | linux-aws | < any | UNKNOWN |
ubuntu | 24.04 | noarch | linux-aws | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws-5.15 | < any | UNKNOWN |
ubuntu | 22.04 | noarch | linux-aws-6.5 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-azure | < any | UNKNOWN |
ubuntu | 22.04 | noarch | linux-azure | < any | UNKNOWN |
git.kernel.org/linus/6648e613226e18897231ab5e42ffc29e63fa3365 (6.9-rc7)
git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27
git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d
git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365
git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80
git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87
launchpad.net/bugs/cve/CVE-2024-36938
nvd.nist.gov/vuln/detail/CVE-2024-36938
security-tracker.debian.org/tracker/CVE-2024-36938
www.cve.org/CVERecord?id=CVE-2024-36938