CVE-2024-26923: af_unix: Fix garbage collector racing against connect()
First published: Wed Apr 24 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list. sockets are AF_UNIX/SOCK_STREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc() ---------------- ------------------------- ----------- NS = unix_create1() skb1 = sock_wmalloc(NS) L = unix_find_other(addr) unix_state_lock(L) unix_peer(S) = NS // V count=1 inflight=0 NS = unix_peer(S) skb2 = sock_alloc() skb_queue_tail(NS, skb2[V]) // V became in-flight // V count=2 inflight=1 close(V) // V count=1 inflight=1 // GC candidate condition met for u in gc_inflight_list: if (total_refs == inflight_refs) add u to gc_candidates // gc_candidates={L, V} for u in gc_candidates: scan_children(u, dec_inflight) // embryo (skb1) was not // reachable from L yet, so V's // inflight remains unchanged __skb_queue_tail(L, skb1) unix_state_unlock(L) for u in gc_candidates: if (u.inflight) scan_children(u, inc_inflight_move_tail) // V count=1 inflight=2 (!) If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains unaffected.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google Android | ||
| redhat/kernel | <5.15.156 | 5.15.156 |
| redhat/kernel | <6.1.87 | 6.1.87 |
| redhat/kernel | <6.6.28 | 6.6.28 |
| redhat/kernel | <6.8.7 | 6.8.7 |
| redhat/kernel | <6.9 | 6.9 |
| F5 Traffix SDC | =5.2.0 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.12.5-1 6.12.6-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/47d8ac011fe1c9251070e1bd64cb10b48193ec51
- https://git.kernel.org/stable/c/507cc232ffe53a352847893f8177d276c3b532a9
- https://git.kernel.org/stable/c/b75722be422c276b699200de90527d01c602ea7c
- https://git.kernel.org/stable/c/dbdf7bec5c920200077d693193f989cb1513f009
- https://git.kernel.org/stable/c/e76c2678228f6aec74b305ae30c9374cc2f28a51
- https://git.kernel.org/stable/c/2e2a03787f4f0abc0072350654ab0ef3324d9db3
- https://git.kernel.org/stable/c/343c5372d5e17b306db5f8f3c895539b06e3177f
- https://git.kernel.org/stable/c/a36ae0ec2353015f0f6762e59f4c2dbc0c906423
- https://launchpad.net/bugs/cve/CVE-2024-26923
- https://android.googlesource.com/kernel/common/+/65e0a92c6d27d4cbaa0deef668df12b69853d65e
- https://android.googlesource.com/kernel/common/+/e8e652b8c81afc06e9bc801f6eb4896516be2d62
- https://android.googlesource.com/kernel/common/+/94c88f80ffddff00f0af448c02dfd8a3f3cdd692
- https://android.googlesource.com/kernel/common/+/d0c6724b0f6fa713e7fcfc0eb0173625519ba570
- https://source.android.com/docs/security/bulletin/2024-07-01 (Advisory)
- https://access.redhat.com/security/cve/CVE-2024-26923
- https://lore.kernel.org/linux-cve-announce/2024042418-CVE-2024-26923-f7f6@gregkh/T
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2277172
- https://access.redhat.com/errata/RHSA-2024:4823
- https://access.redhat.com/errata/RHSA-2024:4831
- https://access.redhat.com/errata/RHSA-2024:7001
- https://access.redhat.com/errata/RHSA-2024:6993
- https://access.redhat.com/errata/RHSA-2024:7000
- https://access.redhat.com/errata/RHSA-2024:7486
- https://access.redhat.com/errata/RHSA-2024:8617
- https://bugzilla.redhat.com/show_bug.cgi?id=2277171
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26923
- https://nvd.nist.gov/vuln/detail/CVE-2024-26923
- https://security-tracker.debian.org/tracker/CVE-2024-26923
- https://ubuntu.com/security/CVE-2024-26923
- https://git.kernel.org/linus/47d8ac011fe1c9251070e1bd64cb10b48193ec51
- https://my.f5.com/manage/s/article/K000148931
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/remedy
- collector/launchpad-cve
- source/Launchpad
- collector/android-source
- source/Android
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-26923
- collector/nvd-cve
- collector/usn-cve
- source/Ubuntu
- agent/description
- collector/f5-advisory
- source/F5
- agent/references
- agent/severity
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/google
- canonical/google android
- package-manager/redhat
- vendor/f5
- canonical/f5 traffix sdc
- version/f5 traffix sdc/5.2.0
- package-manager/debian