CVE-2024-46771: can: bcm: Remove proc entry when dev is unregistered.
In the Linux kernel, the following vulnerability has been resolved:
can: bcm: Remove proc entry when dev is unregistered.
syzkaller reported a warning in bcmconnect() below. [0]
The repro calls connect() to vxcan1, removes vxcan1, and calls connect() with ifindex == 0.
Calling connect() for a BCM socket allocates a proc entry. Then, bcmsk(sk)->bound is set to 1 to prevent further connect().
However, removing the bound device resets bcmsk(sk)->bound to 0 in bcmnotify().
The 2nd connect() tries to allocate a proc entry with the same name and sets NULL to bcmsk(sk)->bcmprocread, leaking the original proc entry.
Since the proc entry is available only for connect()ed sockets, let's clean up the entry when the bound netdev is unregistered.
[0]: procdirentry 'can-bcm/2456' already registered WARNING: CPU: 1 PID: 394 at fs/proc/generic.c:376 procregister+0x645/0x8f0 fs/proc/generic.c:375 Modules linked in: CPU: 1 PID: 394 Comm: syz-executor403 Not tainted 6.10.0-rc7-g852e42cc2dd4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:procregister+0x645/0x8f0 fs/proc/generic.c:375 Code: 00 00 00 00 00 48 85 ed 0f 85 97 02 00 00 4d 85 f6 0f 85 9f 02 00 00 48 c7 c7 9b cb cf 87 48 89 de 4c 89 fa e8 1c 6f eb fe 90 <0f> 0b 90 90 48 c7 c7 98 37 99 89 e8 cb 7e 22 05 bb 00 00 00 10 48 RSP: 0018:ffa0000000cd7c30 EFLAGS: 00010246 RAX: 9e129be1950f0200 RBX: ff1100011b51582c RCX: ff1100011857cd80 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 RBP: 0000000000000000 R08: ffd400000000000f R09: ff1100013e78cac0 R10: ffac800000cd7980 R11: ff1100013e12b1f0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ff1100011a99a2ec FS: 00007fbd7086f740(0000) GS:ff1100013fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200071c0 CR3: 0000000118556004 CR4: 0000000000771ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> proccreatenetsingle+0x144/0x210 fs/proc/procnet.c:220 bcmconnect+0x472/0x840 net/can/bcm.c:1673 sysconnectfile net/socket.c:2049 [inline] sysconnect+0x5d2/0x690 net/socket.c:2066 dosysconnect net/socket.c:2076 [inline] sesysconnect net/socket.c:2073 [inline] x64sysconnect+0x8f/0x100 net/socket.c:2073 dosyscallx64 arch/x86/entry/common.c:52 [inline] dosyscall64+0xd9/0x1c0 arch/x86/entry/common.c:83 entrySYSCALL64afterhwframe+0x4b/0x53 RIP: 0033:0x7fbd708b0e5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007fff8cd33f08 EFLAGS: 00000246 ORIGRAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fbd708b0e5d RDX: 0000000000000010 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000040 R09: 0000000000000040 R10: 0000000000000040 R11: 0000000000000246 R12: 00007fff8cd34098 R13: 0000000000401280 R14: 0000000000406de8 R15: 00007fbd70ab9000 </TASK> removeprocentry: removing non-empty directory 'net/can-bcm', leaking at least '2456'
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
Apply the upstream Linux kernel fix so that in can-bcm, the proc entry created for connect()-allocated BCM sockets is removed/cleaned up when the bound netdev is unregistered (prevents bcm_proc_read being NULLed while the original proc entry remains, causing a proc_dir_entry like 'can-bcm/2456' to remain and trigger 'already registered' / leaking warnings).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46771?
CVE-2024-46771 has a high severity level due to potential impacts on kernel stability and security.
How do I fix CVE-2024-46771?
To fix CVE-2024-46771, update your Linux kernel to versions 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
Which Linux kernel versions are affected by CVE-2024-46771?
Affected Linux kernel versions are from 2.6.25 up to 6.1.110, beyond which the vulnerability is resolved.
What does CVE-2024-46771 affect in the Linux kernel?
CVE-2024-46771 affects the CAN interface, specifically related to processing warnings when a device is unregistered.
Is there a workaround for CVE-2024-46771 if I cannot update?
There are no specific workarounds for CVE-2024-46771; updating to a fixed version is recommended.