CVE-2024-35910
Vulnerability from cvelistv5
Published
2024-05-19 08:35
Modified
2024-12-19 08:58
Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
tcp: properly terminate timers for kernel sockets
We had various syzbot reports about tcp timers firing after
the corresponding netns has been dismantled.
Fortunately Josef Bacik could trigger the issue more often,
and could test a patch I wrote two years ago.
When TCP sockets are closed, we call inet_csk_clear_xmit_timers()
to 'stop' the timers.
inet_csk_clear_xmit_timers() can be called from any context,
including when socket lock is held.
This is the reason it uses sk_stop_timer(), aka del_timer().
This means that ongoing timers might finish much later.
For user sockets, this is fine because each running timer
holds a reference on the socket, and the user socket holds
a reference on the netns.
For kernel sockets, we risk that the netns is freed before
timer can complete, because kernel sockets do not hold
reference on the netns.
This patch adds inet_csk_clear_xmit_timers_sync() function
that using sk_stop_timer_sync() to make sure all timers
are terminated before the kernel socket is released.
Modules using kernel sockets close them in their netns exit()
handler.
Also add sock_not_owned_by_me() helper to get LOCKDEP
support : inet_csk_clear_xmit_timers_sync() must not be called
while socket lock is held.
It is very possible we can revert in the future commit
3a58f13a881e ("net: rds: acquire refcount on TCP sockets")
which attempted to solve the issue in rds only.
(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)
We probably can remove the check_net() tests from
tcp_out_of_resources() and __tcp_close() in the future.
References
Impacted products
| Vendor | Product | Version | |||||
|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: 8a68173691f036613e3d4e6bf8dc129d4a7bf383 Version: 8a68173691f036613e3d4e6bf8dc129d4a7bf383 Version: 8a68173691f036613e3d4e6bf8dc129d4a7bf383 Version: 8a68173691f036613e3d4e6bf8dc129d4a7bf383 Version: 8a68173691f036613e3d4e6bf8dc129d4a7bf383 Version: 8a68173691f036613e3d4e6bf8dc129d4a7bf383 Version: 8a68173691f036613e3d4e6bf8dc129d4a7bf383 Version: 8a68173691f036613e3d4e6bf8dc129d4a7bf383 |
||||
|
|||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-35910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-29T18:25:39.390284Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T19:44:27.885Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:21:48.925Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7f"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7de"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35a"
},
{
"tags": [
"x_transferred"
],
"url": "https://git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/inet_connection_sock.h",
"include/net/sock.h",
"net/ipv4/inet_connection_sock.c",
"net/ipv4/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "93f0133b9d589cc6e865f254ad9be3e9d8133f50",
"status": "affected",
"version": "8a68173691f036613e3d4e6bf8dc129d4a7bf383",
"versionType": "git"
},
{
"lessThan": "44e62f5d35678686734afd47c6a421ad30772e7f",
"status": "affected",
"version": "8a68173691f036613e3d4e6bf8dc129d4a7bf383",
"versionType": "git"
},
{
"lessThan": "e3e27d2b446deb1f643758a0c4731f5c22492810",
"status": "affected",
"version": "8a68173691f036613e3d4e6bf8dc129d4a7bf383",
"versionType": "git"
},
{
"lessThan": "2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4",
"status": "affected",
"version": "8a68173691f036613e3d4e6bf8dc129d4a7bf383",
"versionType": "git"
},
{
"lessThan": "91b243de910a9ac8476d40238ab3dbfeedd5b7de",
"status": "affected",
"version": "8a68173691f036613e3d4e6bf8dc129d4a7bf383",
"versionType": "git"
},
{
"lessThan": "c1ae4d1e76eacddaacb958b67cd942082f800c87",
"status": "affected",
"version": "8a68173691f036613e3d4e6bf8dc129d4a7bf383",
"versionType": "git"
},
{
"lessThan": "899265c1389fe022802aae73dbf13ee08837a35a",
"status": "affected",
"version": "8a68173691f036613e3d4e6bf8dc129d4a7bf383",
"versionType": "git"
},
{
"lessThan": "151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada",
"status": "affected",
"version": "8a68173691f036613e3d4e6bf8dc129d4a7bf383",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/inet_connection_sock.h",
"include/net/sock.h",
"net/ipv4/inet_connection_sock.c",
"net/ipv4/tcp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.312",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.274",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.215",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.85",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.26",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.8.*",
"status": "unaffected",
"version": "6.8.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.9",
"versionType": "original_commit_for_fix"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: properly terminate timers for kernel sockets\n\nWe had various syzbot reports about tcp timers firing after\nthe corresponding netns has been dismantled.\n\nFortunately Josef Bacik could trigger the issue more often,\nand could test a patch I wrote two years ago.\n\nWhen TCP sockets are closed, we call inet_csk_clear_xmit_timers()\nto \u0027stop\u0027 the timers.\n\ninet_csk_clear_xmit_timers() can be called from any context,\nincluding when socket lock is held.\nThis is the reason it uses sk_stop_timer(), aka del_timer().\nThis means that ongoing timers might finish much later.\n\nFor user sockets, this is fine because each running timer\nholds a reference on the socket, and the user socket holds\na reference on the netns.\n\nFor kernel sockets, we risk that the netns is freed before\ntimer can complete, because kernel sockets do not hold\nreference on the netns.\n\nThis patch adds inet_csk_clear_xmit_timers_sync() function\nthat using sk_stop_timer_sync() to make sure all timers\nare terminated before the kernel socket is released.\nModules using kernel sockets close them in their netns exit()\nhandler.\n\nAlso add sock_not_owned_by_me() helper to get LOCKDEP\nsupport : inet_csk_clear_xmit_timers_sync() must not be called\nwhile socket lock is held.\n\nIt is very possible we can revert in the future commit\n3a58f13a881e (\"net: rds: acquire refcount on TCP sockets\")\nwhich attempted to solve the issue in rds only.\n(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)\n\nWe probably can remove the check_net() tests from\ntcp_out_of_resources() and __tcp_close() in the future."
}
],
"providerMetadata": {
"dateUpdated": "2024-12-19T08:58:04.643Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50"
},
{
"url": "https://git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7f"
},
{
"url": "https://git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810"
},
{
"url": "https://git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4"
},
{
"url": "https://git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7de"
},
{
"url": "https://git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87"
},
{
"url": "https://git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35a"
},
{
"url": "https://git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada"
}
],
"title": "tcp: properly terminate timers for kernel sockets",
"x_generator": {
"engine": "bippy-5f407fcff5a0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-35910",
"datePublished": "2024-05-19T08:35:03.287Z",
"dateReserved": "2024-05-17T13:50:33.121Z",
"dateUpdated": "2024-12-19T08:58:04.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-35910\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-19T09:15:11.617\",\"lastModified\":\"2024-11-21T09:21:10.933\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: properly terminate timers for kernel sockets\\n\\nWe had various syzbot reports about tcp timers firing after\\nthe corresponding netns has been dismantled.\\n\\nFortunately Josef Bacik could trigger the issue more often,\\nand could test a patch I wrote two years ago.\\n\\nWhen TCP sockets are closed, we call inet_csk_clear_xmit_timers()\\nto \u0027stop\u0027 the timers.\\n\\ninet_csk_clear_xmit_timers() can be called from any context,\\nincluding when socket lock is held.\\nThis is the reason it uses sk_stop_timer(), aka del_timer().\\nThis means that ongoing timers might finish much later.\\n\\nFor user sockets, this is fine because each running timer\\nholds a reference on the socket, and the user socket holds\\na reference on the netns.\\n\\nFor kernel sockets, we risk that the netns is freed before\\ntimer can complete, because kernel sockets do not hold\\nreference on the netns.\\n\\nThis patch adds inet_csk_clear_xmit_timers_sync() function\\nthat using sk_stop_timer_sync() to make sure all timers\\nare terminated before the kernel socket is released.\\nModules using kernel sockets close them in their netns exit()\\nhandler.\\n\\nAlso add sock_not_owned_by_me() helper to get LOCKDEP\\nsupport : inet_csk_clear_xmit_timers_sync() must not be called\\nwhile socket lock is held.\\n\\nIt is very possible we can revert in the future commit\\n3a58f13a881e (\\\"net: rds: acquire refcount on TCP sockets\\\")\\nwhich attempted to solve the issue in rds only.\\n(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)\\n\\nWe probably can remove the check_net() tests from\\ntcp_out_of_resources() and __tcp_close() in the future.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tcp: termina correctamente los temporizadores para los sockets del kernel. Recibimos varios informes de syzbot sobre los temporizadores tcp que se activan despu\u00e9s de que se han desmantelado las redes correspondientes. Afortunadamente, Josef Bacik pudo provocar el problema con m\u00e1s frecuencia y pudo probar un parche que escrib\u00ed hace dos a\u00f1os. Cuando los sockets TCP est\u00e1n cerrados, llamamos a inet_csk_clear_xmit_timers() para \\\"detener\\\" los temporizadores. Se puede llamar a inet_csk_clear_xmit_timers() desde cualquier contexto, incluso cuando se mantiene el bloqueo del socket. Esta es la raz\u00f3n por la que usa sk_stop_timer(), tambi\u00e9n conocido como del_timer(). Esto significa que los cron\u00f3metros en curso podr\u00edan finalizar mucho m\u00e1s tarde. Para los sockets de usuario, esto est\u00e1 bien porque cada temporizador en ejecuci\u00f3n tiene una referencia en el socket, y el socket de usuario tiene una referencia en las redes. Para los sockets del kernel, corremos el riesgo de que la red se libere antes de que se complete el temporizador, porque los sockets del kernel no mantienen referencias en las redes. Este parche agrega la funci\u00f3n inet_csk_clear_xmit_timers_sync() que usa sk_stop_timer_sync() para garantizar que todos los temporizadores finalicen antes de que se libere el socket del kernel. Los m\u00f3dulos que utilizan sockets del kernel los cierran en su controlador netns exit(). Tambi\u00e9n agregue el asistente sock_not_owned_by_me() para obtener soporte LOCKDEP: no se debe llamar a inet_csk_clear_xmit_timers_sync() mientras se mantiene el bloqueo del socket. Es muy posible que podamos revertir en el futuro la confirmaci\u00f3n 3a58f13a881e (\\\"net: rds: adquirir refcount en sockets TCP\\\") que intent\u00f3 resolver el problema solo en rds. (net/smc/af_smc.c y net/mptcp/subflow.c tienen c\u00f3digo similar) Probablemente podamos eliminar las pruebas check_net() de tcp_out_of_resources() y __tcp_close() en el futuro.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":4.7}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7de\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7de\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}