CVE-2024-26780

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix task hung while purging oob_skb in GC.

syzbot reported a task hung; at the same time, GC was looping infinitely

in list_for_each_entry_safe() for OOB skb. [0]

syzbot demonstrated that the list_for_each_entry_safe() was not actually

safe in this case.

A single skb could have references for multiple sockets. If we free such

a skb in the list_for_each_entry_safe(), the current and next sockets could

be unlinked in a single iteration.

unix_notinflight() uses list_del_init() to unlink the socket, so the

prefetched next socket forms a loop itself and list_for_each_entry_safe()

never stops.

Here, we must use while() and make sure we always fetch the first socket.

[0]:

Sending NMI from CPU 0 to CPUs 1:

NMI backtrace for cpu 1

CPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/202

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References