CVE-2024-36972

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and queue_oob(). __unix_gc() tries to garbage-collect close()d inflight sockets, and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC will drop the reference and set NULL to it locklessly. However, the peer socket still can send MSG_OOB message and queue_oob() can update unix_sk(sk)->oob_skb concurrently, leading NULL pointer dereference. [0] To fix the issue, let's update unix_sk(sk)->oob_s...

Affected product and versions

Product

Linux Linux, linux_kernel, linux kernel

Affected versions

>= 4fe505c63aa3273135a57597fda761e9aecc7668 < 518a994aa0b87d96f1bc6678a7035df5d1fcd7a1, >= e0e09186d8821ad59806115d347ea32efa43ca4b < 4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1, >= b74aa9ce13d02b7fd37c5325b99854f91b9b4276 < d59ae9314b97e01c76a4171472441e55721ba636, >= 1279f9d9dec2d7462823a18c29ad61359e0a007d < 4708f49add84a57ce0ccc7bf9a6269845c631cc3, >= 1279f9d9dec2d7462823a18c29ad61359e0a007d < 9841991a446c87f90f66f4b9fee6fe934c1336a2, >= 82ae47c5c3a6b27fdc0f9e83c1499cb439c56140, >= 5.15.149 < 5.15.161, >= 6.1.78 < 6.1.93, >= 6.6.17 < 6.6.33, >= 6.7.5 < 6.8, >= 6.8, >= 4fe505c63aa3 < 518a994aa0b8, >= e0e09186d882 < 4bf6964451c3, >= b74aa9ce13d0 < d59ae9314b97, >= 1279f9d9dec2 < 4708f49add84, >= 1279f9d9dec2 < 9841991a446c, >= 6.7.5 < 6.9.4

Fixed versions

5.15.161, 6.1.93, 6.6.33, 6.9.4

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-476