CVE-2024-47711

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Don't return OOB skb in manage_oob().

syzbot reported use-after-free in unix_stream_recv_urg(). [0]

The scenario is

1. send(MSG_OOB)

2. recv(MSG_OOB)

-> The consumed OOB remains in recv queue

3. send(MSG_OOB)

4. recv()

-> manage_oob() returns the next skb of the consumed OOB

-> This is also OOB, but unix_sk(sk)->oob_skb is not cleared

5. recv(MSG_OOB)

-> unix_sk(sk)->oob_skb is used but already freed

The recent commit 8594d9b85c07 ("af_unix: Don't call skb_get() for OOB

skb.") uncovered the issue.

If the OOB skb is consumed and the next skb is peeked in manage_oob(),

we still need to check if the skb is OOB.

Let's do so by falling back to the following checks in manage_oob()

and add the test case in selftest.

Note that we need to add a similar check for SIOCATMARK.

[0]:

BUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959

Read of siz

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References