cve-2024-36938
Vulnerability from cvelistv5
Published
2024-05-30 15:29
Modified
2024-12-19 09:02
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which syzbot reported [1]. [1] BUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue write to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [inline] sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843 sk_psock_put include/linux/skmsg.h:459 [inline] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [inline] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 read to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0: sk_psock_data_ready include/linux/skmsg.h:464 [inline] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net/core/skmsg.c:1008 [inline] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [inline] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x312/0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [inline] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 entry_SYSCALL_64_after_hwframe+0x6d/0x75 value changed: 0xffffffff83d7feb0 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G W 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024 Prior to this, commit 4cd12c6065df ("bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()") fixed one NULL pointer similarly due to no protection of saved_data_ready. Here is another different caller causing the same issue because of the same reason. So we should protect it with sk_callback_lock read lock because the writer side in the sk_psock_drop() uses "write_lock_bh(&sk->sk_callback_lock);". To avoid errors that could happen in future, I move those two pairs of lock into the sk_psock_data_ready(), which is suggested by John Fastabend.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916dPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916dPatch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87Patch
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973
Impacted products
Vendor Product Version
Linux Linux Version: 604326b41a6fb9b4a78b6179335decee0365cd8c
Version: 604326b41a6fb9b4a78b6179335decee0365cd8c
Version: 604326b41a6fb9b4a78b6179335decee0365cd8c
Version: 604326b41a6fb9b4a78b6179335decee0365cd8c
Version: 604326b41a6fb9b4a78b6179335decee0365cd8c
Version: 604326b41a6fb9b4a78b6179335decee0365cd8c
 Create a notification for this product.
   Linux Linux Version: 4.20
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-36938",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-06-04T15:38:33.489892Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-06-04T17:48:04.434Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T03:43:50.528Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "include/linux/skmsg.h",
                  "net/core/skmsg.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "c0809c128dad4c3413818384eb06a341633db973",
                     status: "affected",
                     version: "604326b41a6fb9b4a78b6179335decee0365cd8c",
                     versionType: "git",
                  },
                  {
                     lessThan: "5965bc7535fb87510b724e5465ccc1a1cf00916d",
                     status: "affected",
                     version: "604326b41a6fb9b4a78b6179335decee0365cd8c",
                     versionType: "git",
                  },
                  {
                     lessThan: "39dc9e1442385d6e9be0b6491ee488dddd55ae27",
                     status: "affected",
                     version: "604326b41a6fb9b4a78b6179335decee0365cd8c",
                     versionType: "git",
                  },
                  {
                     lessThan: "b397a0ab8582c533ec0c6b732392f141fc364f87",
                     status: "affected",
                     version: "604326b41a6fb9b4a78b6179335decee0365cd8c",
                     versionType: "git",
                  },
                  {
                     lessThan: "772d5729b5ff0df0d37b32db600ce635b2172f80",
                     status: "affected",
                     version: "604326b41a6fb9b4a78b6179335decee0365cd8c",
                     versionType: "git",
                  },
                  {
                     lessThan: "6648e613226e18897231ab5e42ffc29e63fa3365",
                     status: "affected",
                     version: "604326b41a6fb9b4a78b6179335decee0365cd8c",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "include/linux/skmsg.h",
                  "net/core/skmsg.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "4.20",
                  },
                  {
                     lessThan: "4.20",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.10.*",
                     status: "unaffected",
                     version: "5.10.223",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.159",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.91",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.31",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.8.*",
                     status: "unaffected",
                     version: "6.8.10",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.9",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue\n\nFix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which\nsyzbot reported [1].\n\n[1]\nBUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue\n\nwrite to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:\n sk_psock_stop_verdict net/core/skmsg.c:1257 [inline]\n sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843\n sk_psock_put include/linux/skmsg.h:459 [inline]\n sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648\n unix_release+0x4b/0x80 net/unix/af_unix.c:1048\n __sock_release net/socket.c:659 [inline]\n sock_close+0x68/0x150 net/socket.c:1421\n __fput+0x2c1/0x660 fs/file_table.c:422\n __fput_sync+0x44/0x60 fs/file_table.c:507\n __do_sys_close fs/open.c:1556 [inline]\n __se_sys_close+0x101/0x1b0 fs/open.c:1541\n __x64_sys_close+0x1f/0x30 fs/open.c:1541\n do_syscall_64+0xd3/0x1d0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nread to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:\n sk_psock_data_ready include/linux/skmsg.h:464 [inline]\n sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555\n sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606\n sk_psock_verdict_apply net/core/skmsg.c:1008 [inline]\n sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202\n unix_read_skb net/unix/af_unix.c:2546 [inline]\n unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682\n sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223\n unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339\n sock_sendmsg_nosec net/socket.c:730 [inline]\n __sock_sendmsg+0x140/0x180 net/socket.c:745\n ____sys_sendmsg+0x312/0x410 net/socket.c:2584\n ___sys_sendmsg net/socket.c:2638 [inline]\n __sys_sendmsg+0x1e9/0x280 net/socket.c:2667\n __do_sys_sendmsg net/socket.c:2676 [inline]\n __se_sys_sendmsg net/socket.c:2674 [inline]\n __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674\n do_syscall_64+0xd3/0x1d0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\n\nvalue changed: 0xffffffff83d7feb0 -> 0x0000000000000000\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G        W          6.8.0-syzkaller-08951-gfe46a7dd189e #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\n\nPrior to this, commit 4cd12c6065df (\"bpf, sockmap: Fix NULL pointer\ndereference in sk_psock_verdict_data_ready()\") fixed one NULL pointer\nsimilarly due to no protection of saved_data_ready. Here is another\ndifferent caller causing the same issue because of the same reason. So\nwe should protect it with sk_callback_lock read lock because the writer\nside in the sk_psock_drop() uses \"write_lock_bh(&sk->sk_callback_lock);\".\n\nTo avoid errors that could happen in future, I move those two pairs of\nlock into the sk_psock_data_ready(), which is suggested by John Fastabend.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T09:02:47.927Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973",
            },
            {
               url: "https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d",
            },
            {
               url: "https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27",
            },
            {
               url: "https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87",
            },
            {
               url: "https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80",
            },
            {
               url: "https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365",
            },
         ],
         title: "bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-36938",
      datePublished: "2024-05-30T15:29:26.929Z",
      dateReserved: "2024-05-30T15:25:07.071Z",
      dateUpdated: "2024-12-19T09:02:47.927Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-36938\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:16.897\",\"lastModified\":\"2024-11-21T09:22:51.723\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue\\n\\nFix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which\\nsyzbot reported [1].\\n\\n[1]\\nBUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue\\n\\nwrite to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:\\n sk_psock_stop_verdict net/core/skmsg.c:1257 [inline]\\n sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843\\n sk_psock_put include/linux/skmsg.h:459 [inline]\\n sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648\\n unix_release+0x4b/0x80 net/unix/af_unix.c:1048\\n __sock_release net/socket.c:659 [inline]\\n sock_close+0x68/0x150 net/socket.c:1421\\n __fput+0x2c1/0x660 fs/file_table.c:422\\n __fput_sync+0x44/0x60 fs/file_table.c:507\\n __do_sys_close fs/open.c:1556 [inline]\\n __se_sys_close+0x101/0x1b0 fs/open.c:1541\\n __x64_sys_close+0x1f/0x30 fs/open.c:1541\\n do_syscall_64+0xd3/0x1d0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nread to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:\\n sk_psock_data_ready include/linux/skmsg.h:464 [inline]\\n sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555\\n sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606\\n sk_psock_verdict_apply net/core/skmsg.c:1008 [inline]\\n sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202\\n unix_read_skb net/unix/af_unix.c:2546 [inline]\\n unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682\\n sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223\\n unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n __sock_sendmsg+0x140/0x180 net/socket.c:745\\n ____sys_sendmsg+0x312/0x410 net/socket.c:2584\\n ___sys_sendmsg net/socket.c:2638 [inline]\\n __sys_sendmsg+0x1e9/0x280 net/socket.c:2667\\n __do_sys_sendmsg net/socket.c:2676 [inline]\\n __se_sys_sendmsg net/socket.c:2674 [inline]\\n __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674\\n do_syscall_64+0xd3/0x1d0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nvalue changed: 0xffffffff83d7feb0 -> 0x0000000000000000\\n\\nReported by Kernel Concurrency Sanitizer on:\\nCPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G        W          6.8.0-syzkaller-08951-gfe46a7dd189e #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\\n\\nPrior to this, commit 4cd12c6065df (\\\"bpf, sockmap: Fix NULL pointer\\ndereference in sk_psock_verdict_data_ready()\\\") fixed one NULL pointer\\nsimilarly due to no protection of saved_data_ready. Here is another\\ndifferent caller causing the same issue because of the same reason. So\\nwe should protect it with sk_callback_lock read lock because the writer\\nside in the sk_psock_drop() uses \\\"write_lock_bh(&sk->sk_callback_lock);\\\".\\n\\nTo avoid errors that could happen in future, I move those two pairs of\\nlock into the sk_psock_data_ready(), which is suggested by John Fastabend.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf, skmsg: Se corrigió la desreferencia del puntero NULL en sk_psock_skb_ingress_enqueue Se corrigieron las ejecucións de datos del puntero NULL en sk_psock_skb_ingress_enqueue() que syzbot informó [1]. [1] ERROR: KCSAN: ejecución de datos en sk_psock_drop / sk_psock_skb_ingress_enqueue escribe en 0xffff88814b3278b8 de 8 bytes por tarea 10724 en la CPU 1: sk_psock_stop_verdict net/core/skmsg.c:1257 [en línea] 0 neto/núcleo/skmsg .c:843 sk_psock_put include/linux/skmsg.h:459 [en línea] sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648 unix_release+0x4b/0x80 net/unix/af_unix.c:1048 __sock_release net/socket. c:659 [en línea] sock_close+0x68/0x150 net/socket.c:1421 __fput+0x2c1/0x660 fs/file_table.c:422 __fput_sync+0x44/0x60 fs/file_table.c:507 __do_sys_close fs/open.c:1556 [en línea] __se_sys_close+0x101/0x1b0 fs/open.c:1541 __x64_sys_close+0x1f/0x30 fs/open.c:1541 do_syscall_64+0xd3/0x1d0 Entry_SYSCALL_64_after_hwframe+0x6d/0x75 leer en 0xffff8881 4b3278b8 de 8 bytes por tarea 10713 en la CPU 0: sk_psock_data_ready include/linux/skmsg.h:464 [en línea] sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555 sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606 sk_psock_verdict_apply net /core/skmsg.c: 1008 [en línea] sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202 unix_read_skb net/unix/af_unix.c:2546 [en línea] unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682 +0x77/0x220 net/core/skmsg.c:1223 unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339 sock_sendmsg_nosec net/socket.c:730 [en línea] __sock_sendmsg+0x140/0x180 net/socket.c:745 ____sys_sendmsg+0x 312/ 0x410 net/socket.c:2584 ___sys_sendmsg net/socket.c:2638 [en línea] __sys_sendmsg+0x1e9/0x280 net/socket.c:2667 __do_sys_sendmsg net/socket.c:2676 [en línea] __se_sys_sendmsg net/socket. c:2674 [en línea] __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674 do_syscall_64+0xd3/0x1d0 Entry_SYSCALL_64_after_hwframe+0x6d/0x75 valor cambiado: 0xffffffff83d7feb0 -> 0x0000000000000000 editado por Kernel Concurrency Sanitizer en: CPU: 0 PID: 10713 Comm: syz-executor .4 Contaminado: GW 6.8.0-syzkaller-08951-gfe46a7dd189e #0 Nombre del hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 29/02/2024 Antes de esto, confirme 4cd12c6065df (\\\"bpf, sockmap: corrija el puntero NULL dereference in sk_psock_verdict_data_ready()\\\") arregló un puntero NULL de manera similar debido a que no hay protección de save_data_ready. Aquí hay otra persona que llama y causa el mismo problema por el mismo motivo. Entonces deberíamos protegerlo con el bloqueo de lectura sk_callback_lock porque el lado del escritor en sk_psock_drop() usa \\\"write_lock_bh(&sk->sk_callback_lock);\\\". Para evitar errores que podrían ocurrir en el futuro, muevo esos dos pares de candados a sk_psock_data_ready(), sugerido por John Fastabend.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.15.159\",\"matchCriteriaId\":\"6FB93658-2709-4338-A4A2-4EF2B669AC04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.91\",\"matchCriteriaId\":\"4F8C886C-75AA-469B-A6A9-12BF1A29C0D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.31\",\"matchCriteriaId\":\"CDDB1F69-36AC-41C1-9192-E7CCEF5FFC00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.10\",\"matchCriteriaId\":\"6A6B920C-8D8F-4130-86B4-AD334F4CF2E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.528Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36938\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-04T15:38:33.489892Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-04T15:38:37.550Z\"}}], \"cna\": {\"title\": \"bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"c0809c128dad4c3413818384eb06a341633db973\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"5965bc7535fb87510b724e5465ccc1a1cf00916d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"39dc9e1442385d6e9be0b6491ee488dddd55ae27\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"b397a0ab8582c533ec0c6b732392f141fc364f87\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"772d5729b5ff0df0d37b32db600ce635b2172f80\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\", \"lessThan\": \"6648e613226e18897231ab5e42ffc29e63fa3365\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/skmsg.h\", \"net/core/skmsg.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.223\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.159\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.91\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.31\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/skmsg.h\", \"net/core/skmsg.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/c0809c128dad4c3413818384eb06a341633db973\"}, {\"url\": \"https://git.kernel.org/stable/c/5965bc7535fb87510b724e5465ccc1a1cf00916d\"}, {\"url\": \"https://git.kernel.org/stable/c/39dc9e1442385d6e9be0b6491ee488dddd55ae27\"}, {\"url\": \"https://git.kernel.org/stable/c/b397a0ab8582c533ec0c6b732392f141fc364f87\"}, {\"url\": \"https://git.kernel.org/stable/c/772d5729b5ff0df0d37b32db600ce635b2172f80\"}, {\"url\": \"https://git.kernel.org/stable/c/6648e613226e18897231ab5e42ffc29e63fa3365\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue\\n\\nFix NULL pointer data-races in sk_psock_skb_ingress_enqueue() which\\nsyzbot reported [1].\\n\\n[1]\\nBUG: KCSAN: data-race in sk_psock_drop / sk_psock_skb_ingress_enqueue\\n\\nwrite to 0xffff88814b3278b8 of 8 bytes by task 10724 on cpu 1:\\n sk_psock_stop_verdict net/core/skmsg.c:1257 [inline]\\n sk_psock_drop+0x13e/0x1f0 net/core/skmsg.c:843\\n sk_psock_put include/linux/skmsg.h:459 [inline]\\n sock_map_close+0x1a7/0x260 net/core/sock_map.c:1648\\n unix_release+0x4b/0x80 net/unix/af_unix.c:1048\\n __sock_release net/socket.c:659 [inline]\\n sock_close+0x68/0x150 net/socket.c:1421\\n __fput+0x2c1/0x660 fs/file_table.c:422\\n __fput_sync+0x44/0x60 fs/file_table.c:507\\n __do_sys_close fs/open.c:1556 [inline]\\n __se_sys_close+0x101/0x1b0 fs/open.c:1541\\n __x64_sys_close+0x1f/0x30 fs/open.c:1541\\n do_syscall_64+0xd3/0x1d0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nread to 0xffff88814b3278b8 of 8 bytes by task 10713 on cpu 0:\\n sk_psock_data_ready include/linux/skmsg.h:464 [inline]\\n sk_psock_skb_ingress_enqueue+0x32d/0x390 net/core/skmsg.c:555\\n sk_psock_skb_ingress_self+0x185/0x1e0 net/core/skmsg.c:606\\n sk_psock_verdict_apply net/core/skmsg.c:1008 [inline]\\n sk_psock_verdict_recv+0x3e4/0x4a0 net/core/skmsg.c:1202\\n unix_read_skb net/unix/af_unix.c:2546 [inline]\\n unix_stream_read_skb+0x9e/0xf0 net/unix/af_unix.c:2682\\n sk_psock_verdict_data_ready+0x77/0x220 net/core/skmsg.c:1223\\n unix_stream_sendmsg+0x527/0x860 net/unix/af_unix.c:2339\\n sock_sendmsg_nosec net/socket.c:730 [inline]\\n __sock_sendmsg+0x140/0x180 net/socket.c:745\\n ____sys_sendmsg+0x312/0x410 net/socket.c:2584\\n ___sys_sendmsg net/socket.c:2638 [inline]\\n __sys_sendmsg+0x1e9/0x280 net/socket.c:2667\\n __do_sys_sendmsg net/socket.c:2676 [inline]\\n __se_sys_sendmsg net/socket.c:2674 [inline]\\n __x64_sys_sendmsg+0x46/0x50 net/socket.c:2674\\n do_syscall_64+0xd3/0x1d0\\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\\n\\nvalue changed: 0xffffffff83d7feb0 -> 0x0000000000000000\\n\\nReported by Kernel Concurrency Sanitizer on:\\nCPU: 0 PID: 10713 Comm: syz-executor.4 Tainted: G        W          6.8.0-syzkaller-08951-gfe46a7dd189e #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024\\n\\nPrior to this, commit 4cd12c6065df (\\\"bpf, sockmap: Fix NULL pointer\\ndereference in sk_psock_verdict_data_ready()\\\") fixed one NULL pointer\\nsimilarly due to no protection of saved_data_ready. Here is another\\ndifferent caller causing the same issue because of the same reason. So\\nwe should protect it with sk_callback_lock read lock because the writer\\nside in the sk_psock_drop() uses \\\"write_lock_bh(&sk->sk_callback_lock);\\\".\\n\\nTo avoid errors that could happen in future, I move those two pairs of\\nlock into the sk_psock_data_ready(), which is suggested by John Fastabend.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:02:47.927Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-36938\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:02:47.927Z\", \"dateReserved\": \"2024-05-30T15:25:07.071Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-30T15:29:26.929Z\", \"assignerShortName\": \"Linux\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.