CVE-2024-36904

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique()

with nice analysis.

Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for

timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's

sk_refcnt after putting it into ehash and releasing the bucket lock.

Thus, there is a small race window where other threads could try to

reuse the port during connect() and call sock_hold() in tcp_twsk_unique()

for the TIME-WAIT socket with zero refcnt.

If that happens, the refcnt taken by tcp_twsk_unique() is overwritten

and sock_put() will cause underflow, triggering a real use-after-free

somewhere else.

To avoid the use-after-free, we need to use refcount_inc_not_zero() in

tcp_twsk_unique() and give up on reusing the port if it returns false.

[0]:

refcount_t: addition on 0; use-after-free.

WARNING: CPU: 0 PID: 1039313 at lib/refc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References