CVE-2024-36972

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock.

Billy Jheng Bing-Jhong reported a race between __unix_gc() and

queue_oob().

__unix_gc() tries to garbage-collect close()d inflight sockets,

and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC

will drop the reference and set NULL to it locklessly.

However, the peer socket still can send MSG_OOB message and

queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading

NULL pointer dereference. [0]

To fix the issue, let's update unix_sk(sk)->oob_skb under the

sk_receive_queue's lock and take it everywhere we touch oob_skb.

Note that we defer kfree_skb() in manage_oob() to silence lockdep

false-positive (See [1]).

[0]:

BUG: kernel NULL pointer dereference, address: 0000000000000008

PF: supervisor write access in kernel mode

PF: error_code(0x0002) - not-present page

PGD 8000000009f5e067 P4D 8000000009f5e067 PUD 9f5d067 PMD 0

Oops: 0002

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References