CVE-2023-53204

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix data-races around user->unix_inflight.

user->unix_inflight is changed under spin_lock(unix_gc_lock),

but too_many_unix_fds() reads it locklessly.

Let's annotate the write/read accesses to user->unix_inflight.

BUG: KCSAN: data-race in unix_attach_fds / unix_inflight

write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1:

unix_inflight+0x157/0x180 net/unix/scm.c:66

unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123

unix_scm_to_skb net/unix/af_unix.c:1827 [inline]

unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950

unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]

unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292

sock_sendmsg_nosec net/socket.c:725 [inline]

sock_sendmsg+0x148/0x160 net/socket.c:748

____sys_sendmsg+0x4e4/0x610 net/socket.c:2494

___sys_sendmsg+0xc6/0x140 net/socket.c:2548

__sys_sendmsg+0x94/0x140 net/socket.c:2577

__do_sys_sendmsg net/socket.c:2586 [inline]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References