In the Linux kernel, the following vulnerability has been resolved:
af_unix: fix struct pid leaks in OOB support
syzbot reported struct pid leak [1].
Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid.
But skb->destructor is not set (either directly or by calling unix_scm_to_skb())
This means that subsequent kfree_skb() or consume_skb() would leak this reference.
In this fix, I chose to fully support scm even for the OOB message.
[1] BUG: memory leak unreferenced object 0xffff8881053e7f80 (size 128): comm "syz-executor242", pid 5066, jiffies 4294946079 (age 13.220s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff812ae26a>] alloc_pid+0x6a/0x560 kernel/pid.c:180 [<ffffffff812718df>] copy_process+0x169f/0x26c0 kernel/fork.c:2285 [<ffffffff81272b37>] kernel_clone+0xf7/0x610 kernel/fork.c:2684 [<ffffffff812730cc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:2825 [<ffffffff849ad699>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff849ad699>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 [<ffffffff84a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-develUpgrade perf-debuginfoUpgrade kernel-livepatch-5.15.104-63.140Upgrade perfUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade kernel | Jun 23, 2025 | May 2, 2025 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-staticUpgrade perfUpgrade kernel-toolsUpgrade kernelUpgrade kernel-libbpf-develUpgrade python3-perfUpgrade kernel-develUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-6.1.21-1.45Upgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf | Jun 24, 2025 | May 2, 2025 |
| Debian | — | Upgrade linux | May 5, 2025 | May 2, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 2, 2025 |
| Ubuntu | — | Upgrade linux-gcp-5.15Upgrade linux-azure-fdeUpgrade linux-realtimeUpgrade linux-bluefieldUpgrade linux-intel-iot-realtimeUpgrade linux-awsUpgrade linux-lowlatency-hwe-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-gcpUpgrade linux-nvidia-tegra-igxUpgrade linux-riscv-5.15Upgrade linux-ibm-5.15Upgrade linux-azureUpgrade linux-aws-5.15Upgrade linux-lowlatencyUpgrade linux-ibmUpgrade linux-intel-iotg-5.15Upgrade linux-oracle-5.15Upgrade linux-kvmUpgrade linux-xilinx-zynqmpUpgrade linux-gkeopUpgrade linux-nvidia-tegraUpgrade linux-nvidiaUpgrade linux-azure-5.15Upgrade linux-oracleUpgrade linux-hwe-5.15Upgrade linuxUpgrade linux-gkeUpgrade linux-intel-iotgUpgrade linux-raspi | May 8, 2025 | May 2, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub