CVE-2024-39500

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sock_map: avoid race between sock_map_close and sk_psock_put

sk_psock_get will return NULL if the refcount of psock has gone to 0, which

will happen when the last call of sk_psock_put is done. However,

sk_psock_drop may not have finished yet, so the close callback will still

point to sock_map_close despite psock being NULL.

This can be reproduced with a thread deleting an element from the sock map,

while the second one creates a socket, adds it to the map and closes it.

That will trigger the WARN_ON_ONCE:

------------[ cut here ]------------

WARNING: CPU: 1 PID: 7220 at net/core/sock_map.c:1701 sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701

Modules linked in:

CPU: 1 PID: 7220 Comm: syz-executor380 Not tainted 6.9.0-syzkaller-07726-g3c999d1ae3c7 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024

RIP: 0010:sock_map_close+0x2a2/0x2d0 net/core/sock_map.c:1701

Code: df e8

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References