CVE-2024-26731: bpf, sockmap: Fix NULL pointer dereference in sk_psock_verdict_data_ready()
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix NULL pointer dereference in skpsockverdictdataready()
syzbot reported the following NULL pointer dereference issue [1]:
BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] RIP: 0010:0x0 [...] Call Trace: <TASK> skpsockverdictdataready+0x232/0x340 net/core/skmsg.c:1230 unixstreamsendmsg+0x9b4/0x1230 net/unix/afunix.c:2293 socksendmsgnosec net/socket.c:730 [inline] socksendmsg+0x221/0x270 net/socket.c:745 syssendmsg+0x525/0x7d0 net/socket.c:2584 syssendmsg net/socket.c:2638 [inline] syssendmsg+0x2b0/0x3a0 net/socket.c:2667 dosyscall64+0xf9/0x240 entrySYSCALL64afterhwframe+0x6f/0x77
If skpsockverdictdataready() and skpsockstopverdict() are called concurrently, psock->saveddataready can be NULL, causing the above issue.
This patch fixes this issue by calling the appropriate data ready function using the skpsockdataready() helper and protecting it from concurrency with sk->skcallbacklock.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26731?
CVE-2024-26731 has been classified as a medium severity vulnerability due to the potential for a NULL pointer dereference in the Linux kernel.
How do I fix CVE-2024-26731?
To fix CVE-2024-26731, you should update your Linux kernel to the latest stable version that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-26731?
CVE-2024-26731 affects various versions of the Linux kernel that have not been updated to include the fix for the NULL pointer dereference issue.
What could happen if CVE-2024-26731 is exploited?
If exploited, CVE-2024-26731 could lead to a denial of service through a kernel crash caused by the NULL pointer dereference.
Who reported the issue of CVE-2024-26731?
The issue for CVE-2024-26731 was reported by syzbot, which is a testing tool for finding bugs in the Linux kernel.