cve-2024-39500
Vulnerability from cvelistv5
Published
2024-07-12 12:20
Modified
2024-12-19 09:07
Severity ?
EPSS score ?
0.09% (0.23255)
Summary
In the Linux kernel, the following vulnerability has been resolved: sock_map: avoid race between sock_map_close and sk_psock_put sk_psock_get will return NULL if the refcount of psock has gone to 0, which will happen when the last call of sk_psock_put is done. However, sk_psock_drop may not have finished yet, so the close callback will still point to sock_map_close despite psock being NULL. This can be reproduced with a thread deleting an element from the sock map, while the second one creates a socket, adds it to the map and closes it. That will trigger the WARN_ON_ONCE: ------------[ cut here ]------------ WARNING: CPU: 1 PID: 7220 at net/core/sock_map.c:1701 sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701 Modules linked in: CPU: 1 PID: 7220 Comm: syz-executor380 Not tainted 6.9.0-syzkaller-07726-g3c999d1ae3c7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024 RIP: 0010:sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701 Code: df e8 92 29 88 f8 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 79 29 88 f8 4c 8b 23 eb 89 e8 4f 15 23 f8 90 <0f> 0b 90 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 13 26 3d 02 RSP: 0018:ffffc9000441fda8 EFLAGS: 00010293 RAX: ffffffff89731ae1 RBX: ffffffff94b87540 RCX: ffff888029470000 RDX: 0000000000000000 RSI: ffffffff8bcab5c0 RDI: ffffffff8c1faba0 RBP: 0000000000000000 R08: ffffffff92f9b61f R09: 1ffffffff25f36c3 R10: dffffc0000000000 R11: fffffbfff25f36c4 R12: ffffffff89731840 R13: ffff88804b587000 R14: ffff88804b587000 R15: ffffffff89731870 FS: 000055555e080380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000207d4000 CR4: 0000000000350ef0 Call Trace: <TASK> unix_release+0x87/0xc0 net/unix/af_unix.c:1048 __sock_release net/socket.c:659 [inline] sock_close+0xbe/0x240 net/socket.c:1421 __fput+0x42b/0x8a0 fs/file_table.c:422 __do_sys_close fs/open.c:1556 [inline] __se_sys_close fs/open.c:1541 [inline] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb37d618070 Code: 00 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d4 e8 10 2c 00 00 80 3d 31 f0 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c RSP: 002b:00007ffcd4a525d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fb37d618070 RDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000004 RBP: 0000000000000000 R08: 0000000100000000 R09: 0000000100000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> Use sk_psock, which will only check that the pointer is not been set to NULL yet, which should only happen after the callbacks are restored. If, then, a reference can still be gotten, we may call sk_psock_stop and cancel psock->work. As suggested by Paolo Abeni, reorder the condition so the control flow is less convoluted. After that change, the reproducer does not trigger the WARN_ON_ONCE anymore.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3627605de498639a3c586c8684d12c89cba11073
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4b4647add7d3c8530493f7247d11e257ee425bf0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5eabdf17fed2ad41b836bb4055ec36d95e512c50
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e946428439a0d2079959f5603256ac51b6047017
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/3627605de498639a3c586c8684d12c89cba11073
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/4b4647add7d3c8530493f7247d11e257ee425bf0
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/5eabdf17fed2ad41b836bb4055ec36d95e512c50
af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/e946428439a0d2079959f5603256ac51b6047017
Impacted products
Vendor Product Version
Linux Linux Version: aadb2bb83ff789de63b48b4edeab7329423a50d3
Version: aadb2bb83ff789de63b48b4edeab7329423a50d3
Version: aadb2bb83ff789de63b48b4edeab7329423a50d3
Version: aadb2bb83ff789de63b48b4edeab7329423a50d3
Version: aadb2bb83ff789de63b48b4edeab7329423a50d3
 Create a notification for this product.
   Linux Linux Version: 5.13
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T04:26:15.539Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/5eabdf17fed2ad41b836bb4055ec36d95e512c50",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/e946428439a0d2079959f5603256ac51b6047017",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/3627605de498639a3c586c8684d12c89cba11073",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://git.kernel.org/stable/c/4b4647add7d3c8530493f7247d11e257ee425bf0",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-39500",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-10T17:07:13.633349Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-11T17:34:40.574Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Linux",
               programFiles: [
                  "net/core/sock_map.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     lessThan: "4959ffc65a0e94f8acaac20deac49f89e6ded52d",
                     status: "affected",
                     version: "aadb2bb83ff789de63b48b4edeab7329423a50d3",
                     versionType: "git",
                  },
                  {
                     lessThan: "5eabdf17fed2ad41b836bb4055ec36d95e512c50",
                     status: "affected",
                     version: "aadb2bb83ff789de63b48b4edeab7329423a50d3",
                     versionType: "git",
                  },
                  {
                     lessThan: "e946428439a0d2079959f5603256ac51b6047017",
                     status: "affected",
                     version: "aadb2bb83ff789de63b48b4edeab7329423a50d3",
                     versionType: "git",
                  },
                  {
                     lessThan: "3627605de498639a3c586c8684d12c89cba11073",
                     status: "affected",
                     version: "aadb2bb83ff789de63b48b4edeab7329423a50d3",
                     versionType: "git",
                  },
                  {
                     lessThan: "4b4647add7d3c8530493f7247d11e257ee425bf0",
                     status: "affected",
                     version: "aadb2bb83ff789de63b48b4edeab7329423a50d3",
                     versionType: "git",
                  },
               ],
            },
            {
               defaultStatus: "affected",
               product: "Linux",
               programFiles: [
                  "net/core/sock_map.c",
               ],
               repo: "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               vendor: "Linux",
               versions: [
                  {
                     status: "affected",
                     version: "5.13",
                  },
                  {
                     lessThan: "5.13",
                     status: "unaffected",
                     version: "0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "5.15.*",
                     status: "unaffected",
                     version: "5.15.162",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.1.*",
                     status: "unaffected",
                     version: "6.1.95",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.6.*",
                     status: "unaffected",
                     version: "6.6.35",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "6.9.*",
                     status: "unaffected",
                     version: "6.9.6",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "*",
                     status: "unaffected",
                     version: "6.10",
                     versionType: "original_commit_for_fix",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "In the Linux kernel, the following vulnerability has been resolved:\n\nsock_map: avoid race between sock_map_close and sk_psock_put\n\nsk_psock_get will return NULL if the refcount of psock has gone to 0, which\nwill happen when the last call of sk_psock_put is done. However,\nsk_psock_drop may not have finished yet, so the close callback will still\npoint to sock_map_close despite psock being NULL.\n\nThis can be reproduced with a thread deleting an element from the sock map,\nwhile the second one creates a socket, adds it to the map and closes it.\n\nThat will trigger the WARN_ON_ONCE:\n\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 7220 at net/core/sock_map.c:1701 sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701\nModules linked in:\nCPU: 1 PID: 7220 Comm: syz-executor380 Not tainted 6.9.0-syzkaller-07726-g3c999d1ae3c7 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\nRIP: 0010:sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701\nCode: df e8 92 29 88 f8 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 79 29 88 f8 4c 8b 23 eb 89 e8 4f 15 23 f8 90 <0f> 0b 90 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 13 26 3d 02\nRSP: 0018:ffffc9000441fda8 EFLAGS: 00010293\nRAX: ffffffff89731ae1 RBX: ffffffff94b87540 RCX: ffff888029470000\nRDX: 0000000000000000 RSI: ffffffff8bcab5c0 RDI: ffffffff8c1faba0\nRBP: 0000000000000000 R08: ffffffff92f9b61f R09: 1ffffffff25f36c3\nR10: dffffc0000000000 R11: fffffbfff25f36c4 R12: ffffffff89731840\nR13: ffff88804b587000 R14: ffff88804b587000 R15: ffffffff89731870\nFS:  000055555e080380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000000 CR3: 00000000207d4000 CR4: 0000000000350ef0\nCall Trace:\n <TASK>\n unix_release+0x87/0xc0 net/unix/af_unix.c:1048\n __sock_release net/socket.c:659 [inline]\n sock_close+0xbe/0x240 net/socket.c:1421\n __fput+0x42b/0x8a0 fs/file_table.c:422\n __do_sys_close fs/open.c:1556 [inline]\n __se_sys_close fs/open.c:1541 [inline]\n __x64_sys_close+0x7f/0x110 fs/open.c:1541\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7fb37d618070\nCode: 00 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d4 e8 10 2c 00 00 80 3d 31 f0 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c\nRSP: 002b:00007ffcd4a525d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\nRAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fb37d618070\nRDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000004\nRBP: 0000000000000000 R08: 0000000100000000 R09: 0000000100000000\nR10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n </TASK>\n\nUse sk_psock, which will only check that the pointer is not been set to\nNULL yet, which should only happen after the callbacks are restored. If,\nthen, a reference can still be gotten, we may call sk_psock_stop and cancel\npsock->work.\n\nAs suggested by Paolo Abeni, reorder the condition so the control flow is\nless convoluted.\n\nAfter that change, the reproducer does not trigger the WARN_ON_ONCE\nanymore.",
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-19T09:07:23.550Z",
            orgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            shortName: "Linux",
         },
         references: [
            {
               url: "https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d",
            },
            {
               url: "https://git.kernel.org/stable/c/5eabdf17fed2ad41b836bb4055ec36d95e512c50",
            },
            {
               url: "https://git.kernel.org/stable/c/e946428439a0d2079959f5603256ac51b6047017",
            },
            {
               url: "https://git.kernel.org/stable/c/3627605de498639a3c586c8684d12c89cba11073",
            },
            {
               url: "https://git.kernel.org/stable/c/4b4647add7d3c8530493f7247d11e257ee425bf0",
            },
         ],
         title: "sock_map: avoid race between sock_map_close and sk_psock_put",
         x_generator: {
            engine: "bippy-5f407fcff5a0",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      assignerShortName: "Linux",
      cveId: "CVE-2024-39500",
      datePublished: "2024-07-12T12:20:34.317Z",
      dateReserved: "2024-06-25T14:23:23.751Z",
      dateUpdated: "2024-12-19T09:07:23.550Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-39500\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-12T13:15:12.537\",\"lastModified\":\"2024-11-21T09:27:49.857\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsock_map: avoid race between sock_map_close and sk_psock_put\\n\\nsk_psock_get will return NULL if the refcount of psock has gone to 0, which\\nwill happen when the last call of sk_psock_put is done. However,\\nsk_psock_drop may not have finished yet, so the close callback will still\\npoint to sock_map_close despite psock being NULL.\\n\\nThis can be reproduced with a thread deleting an element from the sock map,\\nwhile the second one creates a socket, adds it to the map and closes it.\\n\\nThat will trigger the WARN_ON_ONCE:\\n\\n------------[ cut here ]------------\\nWARNING: CPU: 1 PID: 7220 at net/core/sock_map.c:1701 sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701\\nModules linked in:\\nCPU: 1 PID: 7220 Comm: syz-executor380 Not tainted 6.9.0-syzkaller-07726-g3c999d1ae3c7 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\\nRIP: 0010:sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701\\nCode: df e8 92 29 88 f8 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 79 29 88 f8 4c 8b 23 eb 89 e8 4f 15 23 f8 90 <0f> 0b 90 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 13 26 3d 02\\nRSP: 0018:ffffc9000441fda8 EFLAGS: 00010293\\nRAX: ffffffff89731ae1 RBX: ffffffff94b87540 RCX: ffff888029470000\\nRDX: 0000000000000000 RSI: ffffffff8bcab5c0 RDI: ffffffff8c1faba0\\nRBP: 0000000000000000 R08: ffffffff92f9b61f R09: 1ffffffff25f36c3\\nR10: dffffc0000000000 R11: fffffbfff25f36c4 R12: ffffffff89731840\\nR13: ffff88804b587000 R14: ffff88804b587000 R15: ffffffff89731870\\nFS:  000055555e080380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000000 CR3: 00000000207d4000 CR4: 0000000000350ef0\\nCall Trace:\\n <TASK>\\n unix_release+0x87/0xc0 net/unix/af_unix.c:1048\\n __sock_release net/socket.c:659 [inline]\\n sock_close+0xbe/0x240 net/socket.c:1421\\n __fput+0x42b/0x8a0 fs/file_table.c:422\\n __do_sys_close fs/open.c:1556 [inline]\\n __se_sys_close fs/open.c:1541 [inline]\\n __x64_sys_close+0x7f/0x110 fs/open.c:1541\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0x7fb37d618070\\nCode: 00 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d4 e8 10 2c 00 00 80 3d 31 f0 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c\\nRSP: 002b:00007ffcd4a525d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\\nRAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fb37d618070\\nRDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000004\\nRBP: 0000000000000000 R08: 0000000100000000 R09: 0000000100000000\\nR10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000\\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\\n </TASK>\\n\\nUse sk_psock, which will only check that the pointer is not been set to\\nNULL yet, which should only happen after the callbacks are restored. If,\\nthen, a reference can still be gotten, we may call sk_psock_stop and cancel\\npsock->work.\\n\\nAs suggested by Paolo Abeni, reorder the condition so the control flow is\\nless convoluted.\\n\\nAfter that change, the reproducer does not trigger the WARN_ON_ONCE\\nanymore.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sock_map: evita la ejecución entre sock_map_close y sk_psock_put sk_psock_get devolverá NULL si el recuento de psock ha llegado a 0, lo que sucederá cuando se realice la última llamada de sk_psock_put. Sin embargo, es posible que sk_psock_drop aún no haya terminado, por lo que la devolución de llamada de cierre seguirá apuntando a sock_map_close a pesar de que psock sea NULL. Esto se puede reproducir con un hilo eliminando un elemento del mapa del calcetín, mientras que el segundo crea un socket, lo agrega al mapa y lo cierra. Eso activará WARN_ON_ONCE: ------------[ cortar aquí ]------------ ADVERTENCIA: CPU: 1 PID: 7220 en net/core/sock_map.c :1701 sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701 Módulos vinculados en: CPU: 1 PID: 7220 Comm: syz-executor380 No contaminado 6.9.0-syzkaller-07726-g3c999d1ae3c7 #0 Nombre de hardware: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/04/2024 RIP: 0010:sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701 Código: df e8 92 29 88 f8 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 79 29 88 f8 4c 8b 23 eb 89 e8 4f 15 23 f8 90 &lt;0f&gt; 0b 90 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 13 26 3d 02 RSP : 0018:ffffc9000441fda8 EFLAGS: 00010293 RAX: ffffffff89731ae1 RBX: ffffffff94b87540 RCX: ffff888029470000 RDX: 0000000000000000 RSI: ffffffff8bcab5c0 RDI: ffffffff8c1faba0 RBP: 0000000000000000 R08: ffffffff92f9b61f R09: 1ffffffff25f36c3 R10: dffffc0000000000 R11: ffffbfff25f36c4 R12: ffffffff89731840 R13: 8804b587000 R14: ffff88804b587000 R15 : ffffffff89731870 FS: 000055555e080380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 CR2: 0000000000000000 CR3: 00000000207d4000 CR4: 0000000000350ef0 Seguimiento de llamadas:  unix_release+0x87/0xc0 net /unix/af_unix.c:1048 __sock_release net/socket.c:659 [en línea] sock_close+0xbe/0x240 net/socket.c:1421 __fput+0x42b/0x8a0 fs/file_table.c:422 __do_sys_close fs/open.c: 1556 [en línea] __se_sys_close fs/open.c:1541 [en línea] __x64_sys_close+0x7f/0x110 fs/open.c:1541 do_syscall_x64 arch/x86/entry/common.c:52 [en línea] do_syscall_64+0xf5/0x240 arch/x86 /entry/common.c:83 Entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb37d618070 Código: 00 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d4 e8 10 2c 00 00 80 3d 31f0 07 00 00 74 17 b8 03 00 00 00 0f 05 &lt;48&gt; 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c RSP: 002b:00007ffcd4a525d8 GS: 00000202 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fb37d618070 RDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000004 RBP: 0000000000000000 R 08: 0000000100000000 R09: 0000000100000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000000 0 R14: 0000000000000000 R15: 0000000000000000  Utilice sk_psock, que solo verificará que el puntero no esté configurado en NULL todavía, lo que solo debería suceder después de que se restablezcan las devoluciones de llamada. Si, entonces, aún se puede obtener una referencia, podemos llamar a sk_psock_stop y cancelar psock-&gt;work. Como sugirió Paolo Abeni, reordene la condición para que el flujo de control sea menos complicado. Después de ese cambio, el reproductor ya no activa WARN_ON_ONCE.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3627605de498639a3c586c8684d12c89cba11073\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4b4647add7d3c8530493f7247d11e257ee425bf0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5eabdf17fed2ad41b836bb4055ec36d95e512c50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e946428439a0d2079959f5603256ac51b6047017\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3627605de498639a3c586c8684d12c89cba11073\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/4b4647add7d3c8530493f7247d11e257ee425bf0\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/5eabdf17fed2ad41b836bb4055ec36d95e512c50\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/e946428439a0d2079959f5603256ac51b6047017\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"cna\": {\"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-07-15T06:50:46.291Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsock_map: avoid race between sock_map_close and sk_psock_put\\n\\nsk_psock_get will return NULL if the refcount of psock has gone to 0, which\\nwill happen when the last call of sk_psock_put is done. However,\\nsk_psock_drop may not have finished yet, so the close callback will still\\npoint to sock_map_close despite psock being NULL.\\n\\nThis can be reproduced with a thread deleting an element from the sock map,\\nwhile the second one creates a socket, adds it to the map and closes it.\\n\\nThat will trigger the WARN_ON_ONCE:\\n\\n------------[ cut here ]------------\\nWARNING: CPU: 1 PID: 7220 at net/core/sock_map.c:1701 sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701\\nModules linked in:\\nCPU: 1 PID: 7220 Comm: syz-executor380 Not tainted 6.9.0-syzkaller-07726-g3c999d1ae3c7 #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024\\nRIP: 0010:sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701\\nCode: df e8 92 29 88 f8 48 8b 1b 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 79 29 88 f8 4c 8b 23 eb 89 e8 4f 15 23 f8 90 <0f> 0b 90 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d e9 13 26 3d 02\\nRSP: 0018:ffffc9000441fda8 EFLAGS: 00010293\\nRAX: ffffffff89731ae1 RBX: ffffffff94b87540 RCX: ffff888029470000\\nRDX: 0000000000000000 RSI: ffffffff8bcab5c0 RDI: ffffffff8c1faba0\\nRBP: 0000000000000000 R08: ffffffff92f9b61f R09: 1ffffffff25f36c3\\nR10: dffffc0000000000 R11: fffffbfff25f36c4 R12: ffffffff89731840\\nR13: ffff88804b587000 R14: ffff88804b587000 R15: ffffffff89731870\\nFS:  000055555e080380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 0000000000000000 CR3: 00000000207d4000 CR4: 0000000000350ef0\\nCall Trace:\\n <TASK>\\n unix_release+0x87/0xc0 net/unix/af_unix.c:1048\\n __sock_release net/socket.c:659 [inline]\\n sock_close+0xbe/0x240 net/socket.c:1421\\n __fput+0x42b/0x8a0 fs/file_table.c:422\\n __do_sys_close fs/open.c:1556 [inline]\\n __se_sys_close fs/open.c:1541 [inline]\\n __x64_sys_close+0x7f/0x110 fs/open.c:1541\\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\nRIP: 0033:0x7fb37d618070\\nCode: 00 00 48 c7 c2 b8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d4 e8 10 2c 00 00 80 3d 31 f0 07 00 00 74 17 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c\\nRSP: 002b:00007ffcd4a525d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\\nRAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fb37d618070\\nRDX: 0000000000000010 RSI: 00000000200001c0 RDI: 0000000000000004\\nRBP: 0000000000000000 R08: 0000000100000000 R09: 0000000100000000\\nR10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000\\nR13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\\n </TASK>\\n\\nUse sk_psock, which will only check that the pointer is not been set to\\nNULL yet, which should only happen after the callbacks are restored. If,\\nthen, a reference can still be gotten, we may call sk_psock_stop and cancel\\npsock->work.\\n\\nAs suggested by Paolo Abeni, reorder the condition so the control flow is\\nless convoluted.\\n\\nAfter that change, the reproducer does not trigger the WARN_ON_ONCE\\nanymore.\"}], \"affected\": [{\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"unaffected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"net/core/sock_map.c\"], \"versions\": [{\"version\": \"aadb2bb83ff7\", \"lessThan\": \"4959ffc65a0e\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aadb2bb83ff7\", \"lessThan\": \"5eabdf17fed2\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aadb2bb83ff7\", \"lessThan\": \"e946428439a0\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aadb2bb83ff7\", \"lessThan\": \"3627605de498\", \"status\": \"affected\", \"versionType\": \"git\"}, {\"version\": \"aadb2bb83ff7\", \"lessThan\": \"4b4647add7d3\", \"status\": \"affected\", \"versionType\": \"git\"}]}, {\"product\": \"Linux\", \"vendor\": \"Linux\", \"defaultStatus\": \"affected\", \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"programFiles\": [\"net/core/sock_map.c\"], \"versions\": [{\"version\": \"5.13\", \"status\": \"affected\"}, {\"version\": \"0\", \"lessThan\": \"5.13\", \"status\": \"unaffected\", \"versionType\": \"custom\"}, {\"version\": \"5.15.162\", \"lessThanOrEqual\": \"5.15.*\", \"status\": \"unaffected\", \"versionType\": \"custom\"}, {\"version\": \"6.1.95\", \"lessThanOrEqual\": \"6.1.*\", \"status\": \"unaffected\", \"versionType\": \"custom\"}, {\"version\": \"6.6.35\", \"lessThanOrEqual\": \"6.6.*\", \"status\": \"unaffected\", \"versionType\": \"custom\"}, {\"version\": \"6.9.6\", \"lessThanOrEqual\": \"6.9.*\", \"status\": \"unaffected\", \"versionType\": \"custom\"}, {\"version\": \"6.10\", \"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"versionType\": \"original_commit_for_fix\"}]}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4959ffc65a0e94f8acaac20deac49f89e6ded52d\"}, {\"url\": \"https://git.kernel.org/stable/c/5eabdf17fed2ad41b836bb4055ec36d95e512c50\"}, {\"url\": \"https://git.kernel.org/stable/c/e946428439a0d2079959f5603256ac51b6047017\"}, {\"url\": \"https://git.kernel.org/stable/c/3627605de498639a3c586c8684d12c89cba11073\"}, {\"url\": \"https://git.kernel.org/stable/c/4b4647add7d3c8530493f7247d11e257ee425bf0\"}], \"title\": \"sock_map: avoid race between sock_map_close and sk_psock_put\", \"x_generator\": {\"engine\": \"bippy-c9c4e1df01b2\"}}, \"adp\": [{\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39500\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:07:13.633349Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2024-09-11T12:42:25.141Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
         cveMetadata: "{\"cveId\": \"CVE-2024-39500\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2024-06-25T14:23:23.751Z\", \"datePublished\": \"2024-07-12T12:20:34.317Z\", \"dateUpdated\": \"2024-08-02T04:26:15.539Z\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.