CVE-2024-57974

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

udp: Deal with race between UDP socket address change and rehash

If a UDP socket changes its local address while it's receiving

datagrams, as a result of connect(), there is a period during which

a lookup operation might fail to find it, after the address is changed

but before the secondary hash (port and address) and the four-tuple

hash (local and remote ports and addresses) are updated.

Secondary hash chains were introduced by commit 30fff9231fad ("udp:

bind() optimisation") and, as a result, a rehash operation became

needed to make a bound socket reachable again after a connect().

This operation was introduced by commit 719f835853a9 ("udp: add

rehash on connect()") which isn't however a complete fix: the

socket will be found once the rehashing completes, but not while

it's pending.

This is noticeable with a socat(1) server in UDP4-LISTEN mode, and a

client sending datagrams to it. After the server receives the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References