CVE-2024-41041

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().

syzkaller triggered the warning [0] in udp_v4_early_demux().

In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount

of the looked-up sk and use sock_pfree() as skb->destructor, so we check

SOCK_RCU_FREE to ensure that the sk is safe to access during the RCU grace

period.

Currently, SOCK_RCU_FREE is flagged for a bound socket after being put

into the hash table. Moreover, the SOCK_RCU_FREE check is done too early

in udp_v[46]_early_demux() and sk_lookup(), so there could be a small race

window:

CPU1 CPU2

---- ----

udp_v4_early_demux() udp_lib_get_port()

| |- hlist_add_head_rcu()

|- sk = __udp4_lib_demux_lookup() |

|- DEBUG_NET_WARN_ON_ONCE(sk_is_refcounted(sk));

`- sock_set_fla

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References