CVE - CVE-2024-26923

CVE-ID
CVE-2024-26923	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list. sockets are AF_UNIX/SOCK_STREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc() ---------------- ------------------------- ----------- NS = unix_create1() skb1 = sock_wmalloc(NS) L = unix_find_other(addr) unix_state_lock(L) unix_peer(S) = NS // V count=1 inflight=0 NS = unix_peer(S) skb2 = sock_alloc() skb_queue_tail(NS, skb2[V]) // V became in-flight // V count=2 inflight=1 close(V) // V count=1 inflight=1 // GC candidate condition met for u in gc_inflight_list: if (total_refs == inflight_refs) add u to gc_candidates // gc_candidates={L, V} for u in gc_candidates: scan_children(u, dec_inflight) // embryo (skb1) was not // reachable from L yet, so V's // inflight remains unchanged __skb_queue_tail(L, skb1) unix_state_unlock(L) for u in gc_candidates: if (u.inflight) scan_children(u, inc_inflight_move_tail) // V count=1 inflight=2 (!) If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains unaffected.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/2e2a03787f4f0abc0072350654ab0ef3324d9db3 URL:https://git.kernel.org/stable/c/2e2a03787f4f0abc0072350654ab0ef3324d9db3 MISC:https://git.kernel.org/stable/c/343c5372d5e17b306db5f8f3c895539b06e3177f URL:https://git.kernel.org/stable/c/343c5372d5e17b306db5f8f3c895539b06e3177f MISC:https://git.kernel.org/stable/c/47d8ac011fe1c9251070e1bd64cb10b48193ec51 URL:https://git.kernel.org/stable/c/47d8ac011fe1c9251070e1bd64cb10b48193ec51 MISC:https://git.kernel.org/stable/c/507cc232ffe53a352847893f8177d276c3b532a9 URL:https://git.kernel.org/stable/c/507cc232ffe53a352847893f8177d276c3b532a9 MISC:https://git.kernel.org/stable/c/b75722be422c276b699200de90527d01c602ea7c URL:https://git.kernel.org/stable/c/b75722be422c276b699200de90527d01c602ea7c MISC:https://git.kernel.org/stable/c/dbdf7bec5c920200077d693193f989cb1513f009 URL:https://git.kernel.org/stable/c/dbdf7bec5c920200077d693193f989cb1513f009 MISC:https://git.kernel.org/stable/c/e76c2678228f6aec74b305ae30c9374cc2f28a51 URL:https://git.kernel.org/stable/c/e76c2678228f6aec74b305ae30c9374cc2f28a51
Assigning CNA
kernel.org
Date Record Created
20240219	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240219)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)