CVE-2024-26831

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: Fix handshake_req_destroy_test1

Recently, handshake_req_destroy_test1 started failing:

Expected handshake_req_destroy_test == req, but

handshake_req_destroy_test == 0000000000000000

req == 0000000060f99b40

not ok 11 req_destroy works

This is because "sock_release(sock)" was replaced with "fput(filp)"

to address a memory leak. Note that sock_release() is synchronous

but fput() usually delays the final close and clean-up.

The delay is not consequential in the other cases that were changed

but handshake_req_destroy_test1 is testing that handshake_req_cancel()

followed by closing the file actually does call the ->hp_destroy

method. Thus the PTR_EQ test at the end has to be sure that the

final close is complete before it checks the pointer.

We cannot use a completion here because if ->hp_destroy is never

called (ie, there is an API bug) then the test will hang.

Reported by: Guenter Roeck <linux

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References