CVE-2024-26741

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().

syzkaller reported a warning [0] in inet_csk_destroy_sock() with no

repro.

WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);

However, the syzkaller's log hinted that connect() failed just before

the warning due to FAULT_INJECTION. [1]

When connect() is called for an unbound socket, we search for an

available ephemeral port. If a bhash bucket exists for the port, we

call __inet_check_established() or __inet6_check_established() to check

if the bucket is reusable.

If reusable, we add the socket into ehash and set inet_sk(sk)->inet_num.

Later, we look up the corresponding bhash2 bucket and try to allocate

it if it does not exist.

Although it rarely occurs in real use, if the allocation fails, we must

revert the changes by check_established(). Otherwise, an unconnected

socket could illegally occupy an ehash entry.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References