CVE-2024-26864: tcp: Fix refcnt handling in __inet_hash_connect().
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix refcnt handling in inethashconnect().
syzbot reported a warning in sknullsdelnodeinitrcu().
The commit 66b60b0c8c4a ("dccp/tcp: Unhash sk from ehash for tb2 alloc failure after checkestalblished().") tried to fix an issue that an unconnected socket occupies an ehash entry when bhash2 allocation fails.
In such a case, we need to revert changes done by checkestablished(), which does not hold refcnt when inserting socket into ehash.
So, to revert the change, we need to sknullsaddnodercu() instead of sknullsaddnodercu().
Otherwise, sockput() will cause refcnt underflow and leak the socket.
[0]: WARNING: CPU: 0 PID: 23948 at include/net/sock.h:799 sknullsdelnodeinitrcu+0x166/0x1a0 include/net/sock.h:799 Modules linked in: CPU: 0 PID: 23948 Comm: syz-executor.2 Not tainted 6.8.0-rc6-syzkaller-00159-gc055fc00c07b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 RIP: 0010:sknullsdelnodeinitrcu+0x166/0x1a0 include/net/sock.h:799 Code: e8 7f 71 c6 f7 83 fb 02 7c 25 e8 35 6d c6 f7 4d 85 f6 0f 95 c0 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 1b 6d c6 f7 90 <0f> 0b 90 eb b2 e8 10 6d c6 f7 4c 89 e7 be 04 00 00 00 e8 63 e7 d2 RSP: 0018:ffffc900032d7848 EFLAGS: 00010246 RAX: ffffffff89cd0035 RBX: 0000000000000001 RCX: 0000000000040000 RDX: ffffc90004de1000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: 1ffff1100439ac26 R08: ffffffff89ccffe3 R09: 1ffff1100439ac28 R10: dffffc0000000000 R11: ffffed100439ac29 R12: ffff888021cd6140 R13: dffffc0000000000 R14: ffff88802a9bf5c0 R15: ffff888021cd6130 FS: 00007f3b823f16c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3b823f0ff8 CR3: 000000004674a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> inethashconnect+0x140f/0x20b0 net/ipv4/inethashtables.c:1139 dccpv6connect+0xcb9/0x1480 net/dccp/ipv6.c:956 inetstreamconnect+0x262/0xf30 net/ipv4/afinet.c:678 inetstreamconnect+0x65/0xa0 net/ipv4/afinet.c:749 sysconnectfile net/socket.c:2048 [inline] sysconnect+0x2df/0x310 net/socket.c:2065 dosysconnect net/socket.c:2075 [inline] sesysconnect net/socket.c:2072 [inline] x64sysconnect+0x7a/0x90 net/socket.c:2072 dosyscall64+0xf9/0x240 entrySYSCALL64afterhwframe+0x6f/0x77 RIP: 0033:0x7f3b8167dda9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3b823f10c8 EFLAGS: 00000246 ORIGRAX: 000000000000002a RAX: ffffffffffffffda RBX: 00007f3b817abf80 RCX: 00007f3b8167dda9 RDX: 000000000000001c RSI: 0000000020000040 RDI: 0000000000000003 RBP: 00007f3b823f1120 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 000000000000000b R14: 00007f3b817abf80 R15: 00007ffd3beb57b8 </TASK>
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch tcp: Fix refcnt handling in __inet_hash_connect() - Upgrade
Upgrade
dccp/tcpto a version that resolves this vulnerability.Patch 66b60b0c8c4a ( - Configuration
Revert the change by using __sk_nulls_add_node_rcu() instead of sk_nulls_add_node_rcu(), so that sock_put() does not cause refcnt underflow and leak the socket.
Linux kernel tcp/dccp hash handling sk_nulls_add_node_rcu vs __sk_nulls_add_node_rcu = use __sk_nulls_add_node_rcu() instead of sk_nulls_add_node_rcu()
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26864?
CVE-2024-26864 has been classified with a medium severity level due to potential disruptions in TCP connection handling.
How do I fix CVE-2024-26864?
To fix CVE-2024-26864, update your Linux kernel to one of the fixed versions listed in the advisory.
Which versions of Linux are affected by CVE-2024-26864?
CVE-2024-26864 affects specific versions of the Linux kernel, including versions 5.10.223-1, 5.10.226-1, 6.1.119-1, and others listed in the advisory.
What is the impact of CVE-2024-26864 on systems?
The impact of CVE-2024-26864 can include potential instability and malfunctioning of TCP connections within affected systems.
Is there a workaround for CVE-2024-26864?
There are no recommended workarounds for CVE-2024-26864, so the best action is to apply the necessary updates.