CVE-2024-56664

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix race between element replace and close()

Element replace (with a socket different from the one stored) may race

with socket's close() link popping & unlinking. __sock_map_delete()

unconditionally unrefs the (wrong) element:

// set map[0] = s0

map_update_elem(map, 0, s0)

// drop fd of s0

close(s0)

sock_map_close()

lock_sock(sk) (s0!)

sock_map_remove_links(sk)

link = sk_psock_link_pop()

sock_map_unlink(sk, link)

sock_map_delete_from_link

// replace map[0] with s1

map_update_elem(map, 0, s1)

sock_map_update_elem

(s1!) lock_sock(sk)

sock_map_update_common

psock = sk_psock(sk)

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References