CVE-2024-57903: net: restrict SO_REUSEPORT to inet sockets
In the Linux kernel, the following vulnerability has been resolved:
net: restrict SOREUSEPORT to inet sockets
After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot [1].
Trying to acquire a mutex in RCU callback is not allowed.
Restrict SOREUSEPORT socket option to inet sockets.
v1 of this patch supported TCP, UDP and SCTP sockets, but fcnal-test.sh test needed RAW and ICMP support.
[1] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:562 inatomic(): 1, irqsdisabled(): 0, nonblock: 0, pid: 24, name: ksoftirqd/1 preemptcount: 100, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by ksoftirqd/1/24: #0: ffffffff8e937ba0 (rcucallback){....}-{0:0}, at: rculockacquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937ba0 (rcucallback){....}-{0:0}, at: rcudobatch kernel/rcu/tree.c:2561 [inline] #0: ffffffff8e937ba0 (rcucallback){....}-{0:0}, at: rcucore+0xa37/0x17a0 kernel/rcu/tree.c:2823 Preemption disabled at: [<ffffffff8161c8c8>] softirqhandlebegin kernel/softirq.c:402 [inline] [<ffffffff8161c8c8>] handlesoftirqs+0x128/0x9b0 kernel/softirq.c:537 CPU: 1 UID: 0 PID: 24 Comm: ksoftirqd/1 Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> dumpstack lib/dumpstack.c:94 [inline] dumpstacklvl+0x241/0x360 lib/dumpstack.c:120 mightresched+0x5d4/0x780 kernel/sched/core.c:8758 mutexlockcommon kernel/locking/mutex.c:562 [inline] mutexlock+0x131/0xee0 kernel/locking/mutex.c:735 cryptoputdefaultnullskcipher+0x18/0x70 crypto/cryptonull.c:179 aeadrelease+0x3d/0x50 crypto/algifaead.c:489 algdorelease crypto/afalg.c:118 [inline] algsockdestruct+0x86/0xc0 crypto/afalg.c:502 skdestruct+0x58/0x5f0 net/core/sock.c:2260 rcudobatch kernel/rcu/tree.c:2567 [inline] rcucore+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handlesoftirqs+0x2d4/0x9b0 kernel/softirq.c:561 runksoftirqd+0xca/0x130 kernel/softirq.c:950 smpbootthreadfn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 retfromfork+0x4b/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x1a/0x30 arch/x86/entry/entry64.S:244 </TASK>
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-57903?
CVE-2024-57903 has a severity rating that reflects its potential impact on the Linux kernel's networking functionality.
How do I fix CVE-2024-57903?
To fix CVE-2024-57903, ensure that you are running the latest version of the Linux kernel that contains the patch for this vulnerability.
What is the impact of CVE-2024-57903?
The impact of CVE-2024-57903 is primarily related to the improper handling of mutexes in the kernel, which can lead to instability in networking operations.
Is CVE-2024-57903 exploitable?
CVE-2024-57903 can be considered exploitable in scenarios where the affected networking features are utilized without proper safeguards.
When was CVE-2024-57903 disclosed?
CVE-2024-57903 was disclosed following an investigation that highlighted the issues with the handling of SO_REUSEPORT in cryptographic sockets.