CVE-2024-35970

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Clear stale u->oob_skb.

syzkaller started to report deadlock of unix_gc_lock after commit

4090fa373f0e ("af_unix: Replace garbage collection algorithm."), but

it just uncovers the bug that has been there since commit 314001f0bf92

("af_unix: Add OOB support").

The repro basically does the following.

from socket import *

from array import array

c1, c2 = socketpair(AF_UNIX, SOCK_STREAM)

c1.sendmsg([b'a'], [(SOL_SOCKET, SCM_RIGHTS, array("i", [c2.fileno()]))], MSG_OOB)

c2.recv(1) # blocked as no normal data in recv queue

c2.close() # done async and unblock recv()

c1.close() # done async and trigger GC

A socket sends its file descriptor to itself as OOB data and tries to

receive normal data, but finally recv() fails due to async close().

The problem here is wrong handling of OOB skb in manage_oob(). When

recvmsg() is called without MSG_OOB, manage_oob() is called to check

if the peeked skb

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References