CVE-2024-50154

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler().

"""

We are seeing a use-after-free from a bpf prog attached to

trace_tcp_retransmit_synack. The program passes the req->sk to the

bpf_sk_storage_get_tracing kernel helper which does check for null

before using it.

"""

The commit 83fccfc3940c ("inet: fix potential deadlock in

reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not

to call del_timer_sync() from reqsk_timer_handler(), but it introduced a

small race window.

Before the timer is called, expire_timers() calls detach_timer(timer, true)

to clear timer->entry.pprev and marks it as not pending.

If reqsk_queue_unlink() checks timer_pending() just after expire_timers()

calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will

continue running and send multiple SYN+ACKs until it expire

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References