CVE-2024-53139

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: fix possible UAF in sctp_v6_available()

A lockdep report [1] with CONFIG_PROVE_RCU_LIST=y hints

that sctp_v6_available() is calling dev_get_by_index_rcu()

and ipv6_chk_addr() without holding rcu.

[1]

=============================

WARNING: suspicious RCU usage

6.12.0-rc5-virtme #1216 Tainted: G W

-----------------------------

net/core/dev.c:876 RCU-list traversed in non-reader section!!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1

1 lock held by sctp_hello/31495:

#0: ffff9f1ebbdb7418 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_bind (./arch/x86/include/asm/jump_label.h:27 net/sctp/socket.c:315) sctp

stack backtrace:

CPU: 7 UID: 0 PID: 31495 Comm: sctp_hello Tainted: G W 6.12.0-rc5-virtme #1216

Tainted: [W]=WARN

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

Call Trace:

<TASK>

dump_stack_lvl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References