CVE-2021-47304

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized

This commit fixes a bug (found by syzkaller) that could cause spurious

double-initializations for congestion control modules, which could cause

memory leaks or other problems for congestion control modules (like CDG)

that allocate memory in their init functions.

The buggy scenario constructed by syzkaller was something like:

(1) create a TCP socket

(2) initiate a TFO connect via sendto()

(3) while socket is in TCP_SYN_SENT, call setsockopt(TCP_CONGESTION),

which calls:

tcp_set_congestion_control() ->

tcp_reinit_congestion_control() ->

tcp_init_congestion_control()

(4) receive ACK, connection is established, call tcp_init_transfer(),

set icsk_ca_initialized=0 (without first calling cc->release()),

call tcp_init_congestion_control() again.

Note that in this sequence tcp_init_congestion_control() is called

twice witho

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References