CVE-2021-47103

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

inet: fully convert sk->sk_rx_dst to RCU rules

syzbot reported various issues around early demux,

one being included in this changelog [1]

sk->sk_rx_dst is using RCU protection without clearly

documenting it.

And following sequences in tcp_v4_do_rcv()/tcp_v6_do_rcv()

are not following standard RCU rules.

[a] dst_release(dst);

[b] sk->sk_rx_dst = NULL;

They look wrong because a delete operation of RCU protected

pointer is supposed to clear the pointer before

the call_rcu()/synchronize_rcu() guarding actual memory freeing.

In some cases indeed, dst could be freed before [b] is done.

We could cheat by clearing sk_rx_dst before calling

dst_release(), but this seems the right time to stick

to standard RCU annotations and debugging facilities.

[1]

BUG: KASAN: use-after-free in dst_check include/net/dst.h:470 [inline]

BUG: KASAN: use-after-free in tcp_v4_early_demux+0x95b/0x960 net/ipv4/tcp_ipv4.c:1792

Read of

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References