CVE-2024-53139: sctp: fix possible UAF in sctp_v6_available()
In the Linux kernel, the following vulnerability has been resolved:
sctp: fix possible UAF in sctpv6available()
A lockdep report [1] with CONFIGPROVERCULIST=y hints that sctpv6available() is calling devgetbyindexrcu() and ipv6chkaddr() without holding rcu.
[1] ============================= WARNING: suspicious RCU usage 6.12.0-rc5-virtme #1216 Tainted: G W ----------------------------- net/core/dev.c:876 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcuscheduleractive = 2, debuglocks = 1 1 lock held by sctphello/31495: #0: ffff9f1ebbdb7418 (sklock-AFINET6){+.+.}-{0:0}, at: sctpbind (./arch/x86/include/asm/jumplabel.h:27 net/sctp/socket.c:315) sctp
stack backtrace: CPU: 7 UID: 0 PID: 31495 Comm: sctphello Tainted: G W 6.12.0-rc5-virtme #1216 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> dumpstacklvl (lib/dumpstack.c:123) lockdeprcususpicious (kernel/locking/lockdep.c:6822) devgetbyindexrcu (net/core/dev.c:876 (discriminator 7)) sctpv6available (net/sctp/ipv6.c:701) sctp sctpdobind (net/sctp/socket.c:400 (discriminator 1)) sctp sctpbind (net/sctp/socket.c:320) sctp inet6bindsk (net/ipv6/afinet6.c:465) ? securitysocketbind (security/security.c:4581 (discriminator 1)) sysbind (net/socket.c:1848 net/socket.c:1869) ? douseraddrfault (./include/linux/rcupdate.h:347 ./include/linux/rcupdate.h:880 ./include/linux/mm.h:729 arch/x86/mm/fault.c:1340) ? douseraddrfault (./arch/x86/include/asm/preempt.h:84 (discriminator 13) ./include/linux/rcupdate.h:98 (discriminator 13) ./include/linux/rcupdate.h:882 (discriminator 13) ./include/linux/mm.h:729 (discriminator 13) arch/x86/mm/fault.c:1340 (discriminator 13)) x64sysbind (net/socket.c:1877 (discriminator 1) net/socket.c:1875 (discriminator 1) net/socket.c:1875 (discriminator 1)) dosyscall64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:130) RIP: 0033:0x7f59b934a1e7 Code: 44 00 00 48 8b 15 39 8c 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b8 31 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 09 8c 0c 00 f7 d8 64 89 01 48 All code ======== 0: 44 00 00 add %r8b,(%rax) 3: 48 8b 15 39 8c 0c 00 mov 0xc8c39(%rip),%rdx # 0xc8c43 a: f7 d8 neg %eax c: 64 89 02 mov %eax,%fs:(%rdx) f: b8 ff ff ff ff mov $0xffffffff,%eax 14: eb bd jmp 0xffffffffffffffd3 16: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1) 1d: 00 00 00 20: 0f 1f 00 nopl (%rax) 23: b8 31 00 00 00 mov $0x31,%eax 28: 0f 05 syscall 2a: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 73 01 jae 0x33 32: c3 ret 33: 48 8b 0d 09 8c 0c 00 mov 0xc8c09(%rip),%rcx # 0xc8c43 3a: f7 d8 neg %eax 3c: 64 89 01 mov %eax,%fs:(%rcx) 3f: 48 rex.W
Code starting with the faulting instruction =========================================== 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax 6: 73 01 jae 0x9 8: c3 ret 9: 48 8b 0d 09 8c 0c 00 mov 0xc8c09(%rip),%rcx # 0xc8c19 10: f7 d8 neg %eax 12: 64 89 01 mov %eax,%fs:(%rcx) 15: 48 rex.W RSP: 002b:00007ffe2d0ad398 EFLAGS: 00000202 ORIGRAX: 0000000000000031 RAX: ffffffffffffffda RBX: 00007ffe2d0ad3d0 RCX: 00007f59b934a1e7 RDX: 000000000000001c RSI: 00007ffe2d0ad3d0 RDI: 0000000000000005 RBP: 0000000000000005 R08: 1999999999999999 R09: 0000000000000000 R10: 00007f59b9253298 R11: 000000000000 ---truncated---
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Operational
After upgrading the Linux kernel, validate that the lockdep RCU warning "RCU-list traversed in non-reader section!!" no longer appears for the reported call path involving sctp_v6_available() calling dev_get_by_index_rcu() and ipv6_chk_addr() without holding rcu.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53139?
CVE-2024-53139 has been categorized as a medium severity vulnerability due to its potential for use-after-free scenarios.
How do I fix CVE-2024-53139?
To fix CVE-2024-53139, upgrade to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-53139?
CVE-2024-53139 affects Linux kernel versions from 6.2 to 6.6.63 and from 6.7 to 6.11.10, including 6.12 release candidates.
What type of vulnerability is CVE-2024-53139?
CVE-2024-53139 is a use-after-free vulnerability within the sctp_v6_available() function in the Linux kernel.
Can CVE-2024-53139 be exploited remotely?
Exploitation of CVE-2024-53139 may require local access or specific network conditions, making it potentially less likely for remote exploitation.