CVE-2024-50186

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: explicitly clear the sk pointer, when pf->create fails

We have recently noticed the exact same KASAN splat as in commit

6cd4a78d962b ("net: do not leave a dangling sk pointer, when socket

creation fails"). The problem is that commit did not fully address the

problem, as some pf->create implementations do not use sk_common_release

in their error paths.

For example, we can use the same reproducer as in the above commit, but

changing ping to arping. arping uses AF_PACKET socket and if packet_create

fails, it will just sk_free the allocated sk object.

While we could chase all the pf->create implementations and make sure they

NULL the freed sk object on error from the socket, we can't guarantee

future protocols will not make the same mistake.

So it is easier to just explicitly NULL the sk pointer upon return from

pf->create in __sock_create. We do know that pf->create always releases the

allocated sk object on err

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References