cve/published/2024/CVE-2024-36484.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-36484: net: relax socket state check at accept time.

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: relax socket state check at accept time.

Christoph reported the following splat:

WARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0
Modules linked in:
CPU: 1 PID: 772 Comm: syz-executor510 Not tainted 6.9.0-rc7-g7da7119fe22b #56
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
RIP: 0010:__inet_accept+0x1f4/0x4a0 net/ipv4/af_inet.c:759
Code: 04 38 84 c0 0f 85 87 00 00 00 41 c7 04 24 03 00 00 00 48 83 c4 10 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc e8 ec b7 da fd <0f> 0b e9 7f fe ff ff e8 e0 b7 da fd 0f 0b e9 fe fe ff ff 89 d9 80
RSP: 0018:ffffc90000c2fc58 EFLAGS: 00010293
RAX: ffffffff836bdd14 RBX: 0000000000000000 RCX: ffff888104668000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffffffff836bdb89 R09: fffff52000185f64
R10: dffffc0000000000 R11: fffff52000185f64 R12: dffffc0000000000
R13: 1ffff92000185f98 R14: ffff88810754d880 R15: ffff8881007b7800
FS:  000000001c772880(0000) GS:ffff88811b280000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb9fcf2e178 CR3: 00000001045d2002 CR4: 0000000000770ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 <TASK>
 inet_accept+0x138/0x1d0 net/ipv4/af_inet.c:786
 do_accept+0x435/0x620 net/socket.c:1929
 __sys_accept4_file net/socket.c:1969 [inline]
 __sys_accept4+0x9b/0x110 net/socket.c:1999
 __do_sys_accept net/socket.c:2016 [inline]
 __se_sys_accept net/socket.c:2013 [inline]
 __x64_sys_accept+0x7d/0x90 net/socket.c:2013
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x58/0x100 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x4315f9
Code: fd ff 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 ab b4 fd ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffdb26d9c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002b
RAX: ffffffffffffffda RBX: 0000000000400300 RCX: 00000000004315f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00000000006e1018 R08: 0000000000400300 R09: 0000000000400300
R10: 0000000000400300 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000040cdf0 R14: 000000000040ce80 R15: 0000000000000055
 </TASK>

The reproducer invokes shutdown() before entering the listener status.
After commit 94062790aedb ("tcp: defer shutdown(SEND_SHUTDOWN) for
TCP_SYN_RECV sockets"), the above causes the child to reach the accept
syscall in FIN_WAIT1 status.

Eric noted we can relax the existing assertion in __inet_accept()

The Linux kernel CVE team has assigned CVE-2024-36484 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.19.314 with commit 34e41a031fd7523bf1cd00a2adca2370aebea270 and fixed in 4.19.319 with commit 7de00adc9bd035d861ba4177848ca0bfa5ed1e04
	Issue introduced in 5.4.276 with commit ed5e279b69e007ce6c0fe82a5a534c1b19783214 and fixed in 5.4.281 with commit 59801e88c99f7c3f44a4d20af6ba6417aa359b5d
	Issue introduced in 5.10.217 with commit 413c33b9f3bc36fdf719690a78824db9f88a9485 and fixed in 5.10.223 with commit 6e03006548c66b979f4e5e9fc797aac4dad82822
	Issue introduced in 5.15.159 with commit 2552c9d9440f8e7a2ed0660911ff00f25b90a0a4 and fixed in 5.15.164 with commit 21c14c556cccd0cb54b71ec5e901e64ba84c7165
	Issue introduced in 6.1.91 with commit 3fe4ef0568a48369b1891395d13ac593b1ba41b1 and fixed in 6.1.93 with commit c09ddc605893df542c6cf8dde6a57a93f7cf0adb
	Issue introduced in 6.6.31 with commit f47d0d32fa94e815fdd78b8b88684873e67939f4 and fixed in 6.6.33 with commit 87bdc9f6f58b4417362d6932b49b828e319f97dc
	Issue introduced in 6.9 with commit 94062790aedb505bdda209b10bea47b294d6394f and fixed in 6.9.4 with commit 5f9a04a94fd1894d7009055ab8e5832a0242dba3
	Issue introduced in 6.9 with commit 94062790aedb505bdda209b10bea47b294d6394f and fixed in 6.10 with commit 26afda78cda3da974fd4c287962c169e9462c495
	Issue introduced in 6.8.10 with commit cbf232ba11bc86a5281b4f00e1151349ef4d45cf

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-36484
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/af_inet.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7de00adc9bd035d861ba4177848ca0bfa5ed1e04
	https://git.kernel.org/stable/c/59801e88c99f7c3f44a4d20af6ba6417aa359b5d
	https://git.kernel.org/stable/c/6e03006548c66b979f4e5e9fc797aac4dad82822
	https://git.kernel.org/stable/c/21c14c556cccd0cb54b71ec5e901e64ba84c7165
	https://git.kernel.org/stable/c/c09ddc605893df542c6cf8dde6a57a93f7cf0adb
	https://git.kernel.org/stable/c/87bdc9f6f58b4417362d6932b49b828e319f97dc
	https://git.kernel.org/stable/c/5f9a04a94fd1894d7009055ab8e5832a0242dba3
	https://git.kernel.org/stable/c/26afda78cda3da974fd4c287962c169e9462c495