CVE-2024-46763

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fou: Fix null-ptr-deref in GRO.

We observed a null-ptr-deref in fou_gro_receive() while shutting down

a host. [0]

The NULL pointer is sk->sk_user_data, and the offset 8 is of protocol

in struct fou.

When fou_release() is called due to netns dismantle or explicit tunnel

teardown, udp_tunnel_sock_release() sets NULL to sk->sk_user_data.

Then, the tunnel socket is destroyed after a single RCU grace period.

So, in-flight udp4_gro_receive() could find the socket and execute the

FOU GRO handler, where sk->sk_user_data could be NULL.

Let's use rcu_dereference_sk_user_data() in fou_from_sock() and add NULL

checks in FOU GRO handlers.

[0]:

BUG: kernel NULL pointer dereference, address: 0000000000000008

PF: supervisor read access in kernel mode

PF: error_code(0x0000) - not-present page

PGD 80000001032f4067 P4D 80000001032f4067 PUD 103240067 PMD 0

SMP PTI

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.216-204.855.amzn2.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References