CVE-2024-44991

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: prevent concurrent execution of tcp_sk_exit_batch

Its possible that two threads call tcp_sk_exit_batch() concurrently,

once from the cleanup_net workqueue, once from a task that failed to clone

a new netns. In the latter case, error unwinding calls the exit handlers

in reverse order for the 'failed' netns.

tcp_sk_exit_batch() calls tcp_twsk_purge().

Problem is that since commit b099ce2602d8 ("net: Batch inet_twsk_purge"),

this function picks up twsk in any dying netns, not just the one passed

in via exit_batch list.

This means that the error unwind of setup_net() can "steal" and destroy

timewait sockets belonging to the exiting netns.

This allows the netns exit worker to proceed to call

WARN_ON_ONCE(!refcount_dec_and_test(&net->ipv4.tcp_death_row.tw_refcount));

without the expected 1 -> 0 transition, which then splats.

At same time, error unwind path that is also running inet_twsk_purge()

will splat as we

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References