CVE-2023-54006

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix data-race around unix_tot_inflight.

unix_tot_inflight is changed under spin_lock(unix_gc_lock), but

unix_release_sock() reads it locklessly.

Let's use READ_ONCE() for unix_tot_inflight.

Note that the writer side was marked by commit 9d6d7f1cb67c ("af_unix:

annote lockless accesses to unix_tot_inflight & gc_in_progress")

BUG: KCSAN: data-race in unix_inflight / unix_release_sock

write (marked) to 0xffffffff871852b8 of 4 bytes by task 123 on cpu 1:

unix_inflight+0x130/0x180 net/unix/scm.c:64

unix_attach_fds+0x137/0x1b0 net/unix/scm.c:123

unix_scm_to_skb net/unix/af_unix.c:1832 [inline]

unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1955

sock_sendmsg_nosec net/socket.c:724 [inline]

sock_sendmsg+0x148/0x160 net/socket.c:747

____sys_sendmsg+0x4e4/0x610 net/socket.c:2493

___sys_sendmsg+0xc6/0x140 net/socket.c:2547

__sys_sendmsg+0x94/0x140 net/socket.c:2576

__do_sys_sendmsg net/socket.c:2585 [

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References