CVE-2024-26923

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix garbage collector racing against connect()

Garbage collector does not take into account the risk of embryo getting

enqueued during the garbage collection. If such embryo has a peer that

carries SCM_RIGHTS, two consecutive passes of scan_children() may see a

different set of children. Leading to an incorrectly elevated inflight

count, and then a dangling pointer within the gc_inflight_list.

sockets are AF_UNIX/SOCK_STREAM

S is an unconnected socket

L is a listening in-flight socket bound to addr, not in fdtable

V's fd will be passed via sendmsg(), gets inflight count bumped

connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc()

---------------- ------------------------- -----------

NS = unix_create1()

skb1 = sock_wmalloc(NS)

L = unix_find_other(addr)

unix_state_lock(L)

unix_peer(S) = NS

// V count=1 inflight=0

NS = unix_peer(S)

skb2 = sock_alloc()

skb_queue_tail(NS, skb2[V])

// V bec

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References