CVE-2024-50154

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handle...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 106e457953315e476b3642ef24be25ed862aaba3, >= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < c964bf65f80a14288d767023a1b300b30f5b9cd0, >= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 8459d61fbf24967839a70235165673148c7c7f17, >= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 5071beb59ee416e8ab456ac8647a4dabcda823b1, >= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 997ae8da14f1639ce6fb66a063dab54031cd61b3, >= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 51e34db64f4e43c7b055ccf881b7f3e0c31bb26d, >= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < e8c526f2bdf1845bedaf6a478816a3d06fa78b8f, >= d3a1196bfc462943694623412d8e03aaf172bdc1, >= 4.1.11 < 4.2, >= 4.2, >= 4.2 < 5.15.170, >= 5.16 < 6.1.115, >= 6.2 < 6.6.59, >= 6.7 < 6.11.6, 6.12

Fixed versions

4.2, 5.15.170, 6.1.115, 6.6.59, 6.11.6

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416