In the Linux kernel, the following vulnerability has been resolved:
af_unix: Drop oob_skb ref before purging queue in GC.
syzbot reported another task hung in __unix_gc(). [0]
The current while loop assumes that all of the left candidates have oob_skb and calling kfree_skb(oob_skb) releases the remaining candidates.
However, I missed a case that oob_skb has self-referencing fd and another fd and the latter sk is placed before the former in the candidate list. Then, the while loop never proceeds, resulting the task hung.
__unix_gc() has the same loop just before purging the collected skb, so we can call kfree_skb(oob_skb) there and let __skb_queue_purge() release all inflight sockets.
[0]: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 2784 Comm: kworker/u4:8 Not tainted 6.8.0-rc4-syzkaller-01028-g71b605d32017 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: events_unbound __unix_gc RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:200 Code: 89 fb e8 23 00 00 00 48 8b 3d 84 f5 1a 0c 48 89 de 5b e9 43 26 57 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0d 90 52 70 7e 65 8b 15 91 52 70 RSP: 0018:ffffc9000a17fa78 EFLAGS: 00000287 RAX: ffffffff8a0a6108 RBX: ffff88802b6c2640 RCX: ffff88802c0b3b80 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffc9000a17fbf0 R08: ffffffff89383f1d R09: 1ffff1100ee5ff84 R10: dffffc0000000000 R11: ffffed100ee5ff85 R12: 1ffff110056d84ee R13: ffffc9000a17fae0 R14: 0000000000000000 R15: ffffffff8f47b840 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffef5687ff8 CR3: 0000000029b34000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <TASK> __unix_gc+0xe69/0xf40 net/unix/garbage.c:343 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 </TASK>
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade kernel-livepatch-5.15.152-100.162 | Aug 28, 2024 | Apr 4, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade kernel-rt-extraUpgrade dtb-appleUpgrade dtb-renesasUpgrade dlm-kmp-azureUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-debugUpgrade kernel-source-vanillaUpgrade dtb-nvidiaUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-docsUpgrade dtb-amdUpgrade kernel-rt_debugUpgrade dtb-sprdUpgrade kernel-64kb-extraUpgrade kernel-defaultUpgrade kernel-azure-extraUpgrade kernel-64kb-develUpgrade kernel-rt-livepatch-develUpgrade kselftests-kmp-defaultUpgrade dtb-hisiliconUpgrade kernel-syms-rtUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-azureUpgrade kernel-azureUpgrade dtb-xilinxUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade dtb-broadcomUpgrade dtb-allwinnerUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-baseUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-develUpgrade kernel-source-rtUpgrade reiserfs-kmp-rtUpgrade dtb-socionextUpgrade kernel-docs-htmlUpgrade dtb-marvellUpgrade dtb-armUpgrade dlm-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-debug-develUpgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-debug-livepatch-develUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-macrosUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-develUpgrade kernel-default-optionalUpgrade kernel-rt-develUpgrade kernel-obs-qaUpgrade kernel-devel-azureUpgrade dtb-freescaleUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade kernel-syms-azureUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-azureUpgrade dtb-apmUpgrade dtb-qcomUpgrade kernel-symsUpgrade kernel-default-vdsoUpgrade dtb-alteraUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmallUpgrade kernel-default-extraUpgrade kernel-azure-livepatch-develUpgrade kernel-64kbUpgrade dtb-exynosUpgrade dtb-amlogicUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade kernel-azure-optionalUpgrade kernel-64kb-livepatch-develUpgrade dtb-rockchipUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-develUpgrade kernel-zfcpdumpUpgrade gfs2-kmp-64kbUpgrade dtb-mediatekUpgrade dlm-kmp-64kbUpgrade kernel-azure-vdsoUpgrade kernel-sourceUpgrade dtb-amazonUpgrade cluster-md-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-default-develUpgrade dtb-lgUpgrade dtb-cavium | Jul 23, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1065-azure-fdeUpgrade linux-image-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-5.15.0-110-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-kvmUpgrade linux-image-5.15.0-1058-nvidia-lowlatencyUpgrade linux-image-5.15.0-1061-oracleUpgrade linux-image-5.15.0-112-genericUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-113-genericUpgrade linux-image-5.15.0-110-lowlatency-64kUpgrade linux-image-5.15.0-1063-awsUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1056-ibmUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1046-gkeopUpgrade linux-image-raspi-nolpaeUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-113-generic-64kUpgrade linux-image-oem-20.04bUpgrade linux-image-gcpUpgrade linux-image-5.15.0-1062-gcpUpgrade linux-image-awsUpgrade linux-image-raspiUpgrade linux-image-azure-lts-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-113-generic-lpaeUpgrade linux-image-5.15.0-1057-ibmUpgrade linux-image-5.15.0-112-generic-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-intelUpgrade linux-image-5.15.0-1066-azureUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-112-generic-lpaeUpgrade linux-image-gkeopUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-1060-gkeUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-genericUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-64kUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-gkeUpgrade linux-image-5.15.0-1058-nvidiaUpgrade linux-image-5.15.0-1060-kvmUpgrade linux-image-5.15.0-1030-xilinx-zynqmpUpgrade linux-image-oem-20.04 | Jul 1, 2024 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub