CVE-2024-50154

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler().

"""

We are seeing a use-after-free from a bpf prog attached to

trace_tcp_retransmit_synack. The program passes the req->sk to the

bpf_sk_storage_get_tracing kernel helper which does check for null

before using it.

"""

The commit 83fccfc3940c ("inet: fix potential deadlock in

reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not

to call del_timer_sync() from reqsk_timer_handler(), but it introduced a

small race window.

Before the timer is called, expire_timers() calls detach_timer(timer, true)

to clear timer->entry.pprev and marks it as not pending.

If reqsk_queue_unlink() checks timer_pending() just after expire_timers()

calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will

continue running and send multiple SYN+ACKs until it expire

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References