GHSA-6c57-xfhw-j26x: Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback
Zephyr's native TCP stack iterates the global connection list in nettcpforeach() (subsys/net/ip/tcp.c) using the SYSSLISTFOREACHCONTAINERSAFE macro, which caches a pointer to the next list node. Prior to this fix the function released tcplock while invoking the per-connection callback and re-acquired it afterwards.
During that window a concurrent tcpconnrelease(), running on the dedicated TCP work-queue thread when a connection's reference count drops to zero (e.g. a remote peer closing or resetting the connection), can remove and kmemslabfree() the cached next connection. When the iterator advances it dereferences the freed (and possibly reallocated) slab memory — a use-after-free that can crash the system (denial of service) and, if the slot has been reused, cause the callback to operate on an attacker-influenced object (potential information disclosure or further fault).
nettcpforeach() is reached in production via the net conn network shell command and via nettcpcloseallforiface() on interface-down; the freeing side is driven by ordinary TCP traffic.
The fix moves the connection/context teardown in tcpconnrelease() inside the tcplock critical section and keeps tcplock held across the callback in nettcpforeach(). The defect was introduced with the modern (TCP2) stack in 2020 and affects releases up to and including v4.4.0.
Affected Software
Event History
Frequently Asked Questions
Which systems are most exposed to this issue?
Systems using Zephyr's native TCP stack are exposed when net_tcp_foreach() can run concurrently with TCP connection teardown. The affected iterator is reached by the net conn network shell command and when an interface is brought down through net_tcp_close_all_for_iface().
What conditions are needed to trigger the use-after-free?
A local user or component must invoke a path that calls net_tcp_foreach(), while concurrent TCP traffic causes a connection reference count to reach zero and tcp_conn_release() frees a connection on the dedicated TCP work-queue thread. A remote peer closing or resetting a connection is an example of traffic that can drive the freeing side.
What is the practical impact?
The stale cached list entry can be dereferenced after its slab memory has been freed, causing a system crash and denial of service. If that slab slot is reused, the callback may instead process an attacker-influenced object, potentially leading to information disclosure or another fault.
What is the relevant remediation?
The fix keeps connection and context teardown in tcp_conn_release() inside the tcp_lock critical section. This prevents the iterator from advancing through a cached next connection that was removed and freed while the callback ran.