CVE-2024-46771

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: bcm: Remove proc entry when dev is unregistered.

syzkaller reported a warning in bcm_connect() below. [0]

The repro calls connect() to vxcan1, removes vxcan1, and calls

connect() with ifindex == 0.

Calling connect() for a BCM socket allocates a proc entry.

Then, bcm_sk(sk)->bound is set to 1 to prevent further connect().

However, removing the bound device resets bcm_sk(sk)->bound to 0

in bcm_notify().

The 2nd connect() tries to allocate a proc entry with the same

name and sets NULL to bcm_sk(sk)->bcm_proc_read, leaking the

original proc entry.

Since the proc entry is available only for connect()ed sockets,

let's clean up the entry when the bound netdev is unregistered.

[0]:

proc_dir_entry 'can-bcm/2456' already registered

WARNING: CPU: 1 PID: 394 at fs/proc/generic.c:376 proc_register+0x645/0x8f0 fs/proc/generic.c:375

Modules linked in:

CPU: 1 PID: 394 Comm: syz-executor403 Not tainted 6.10.0-rc7-g852e42cc

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References