CVE-2024-44935

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: Fix null-ptr-deref in reuseport_add_sock().

syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in

reuseport_add_sock(). [0]

The repro first creates a listener with SO_REUSEPORT. Then, it creates

another listener on the same port and concurrently closes the first

listener.

The second listen() calls reuseport_add_sock() with the first listener as

sk2, where sk2->sk_reuseport_cb is not expected to be cleared concurrently,

but the close() does clear it by reuseport_detach_sock().

The problem is SCTP does not properly synchronise reuseport_alloc(),

reuseport_add_sock(), and reuseport_detach_sock().

The caller of reuseport_alloc() and reuseport_{add,detach}_sock() must

provide synchronisation for sockets that are classified into the same

reuseport group.

Otherwise, such sockets form multiple identical reuseport groups, and

all groups except one would be silently dead.

1. Two sockets call l

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References