cve/rejected/2024/CVE-2024-54680.json

{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix TCP timers deadlock after rmmod\n\nCommit ef7134c7fc48 (\"smb: client: Fix use-after-free of network namespace.\")\nfixed a netns UAF by manually enabled socket refcounting\n(sk->sk_net_refcnt=1 and sock_inuse_add(net, 1)).\n\nThe reason the patch worked for that bug was because we now hold\nreferences to the netns (get_net_track() gets a ref internally)\nand they're properly released (internally, on __sk_destruct()),\nbut only because sk->sk_net_refcnt was set.\n\nProblem:\n(this happens regardless of CONFIG_NET_NS_REFCNT_TRACKER and regardless\nif init_net or other)\n\nSetting sk->sk_net_refcnt=1 *manually* and *after* socket creation is not\nonly out of cifs scope, but also technically wrong -- it's set conditionally\nbased on user (=1) vs kernel (=0) sockets.  And net/ implementations\nseem to base their user vs kernel space operations on it.\n\ne.g. upon TCP socket close, the TCP timers are not cleared because\nsk->sk_net_refcnt=1:\n(cf. commit 151c9c724d05 (\"tcp: properly terminate timers for kernel sockets\"))\n\nnet/ipv4/tcp.c:\n    void tcp_close(struct sock *sk, long timeout)\n    {\n    \tlock_sock(sk);\n    \t__tcp_close(sk, timeout);\n    \trelease_sock(sk);\n    \tif (!sk->sk_net_refcnt)\n    \t\tinet_csk_clear_xmit_timers_sync(sk);\n    \tsock_put(sk);\n    }\n\nWhich will throw a lockdep warning and then, as expected, deadlock on\ntcp_write_timer().\n\nA way to reproduce this is by running the reproducer from ef7134c7fc48\nand then 'rmmod cifs'.  A few seconds later, the deadlock/lockdep\nwarning shows up.\n\nFix:\nWe shouldn't mess with socket internals ourselves, so do not set\nsk_net_refcnt manually.\n\nAlso change __sock_create() to sock_create_kern() for explicitness.\n\nAs for non-init_net network namespaces, we deal with it the best way\nwe can -- hold an extra netns reference for server->ssocket and drop it\nwhen it's released.  This ensures that the netns still exists whenever\nwe need to create/destroy server->ssocket, but is not directly tied to\nit."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "fs/smb/client/connect.c"
               ],
               "versions": [
                  {
                     "version": "e8c71494181153a134c96da28766a57bd1eac8cb",
                     "lessThan": "906807c734ed219dcb2e7bbfde5c4168ed72a3d0",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "ef7134c7fc48e1441b398e55a862232868a6f0a7",
                     "lessThan": "127e907e11ccd54b59bb78fc22c43ccb76c71079",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "ef7134c7fc48e1441b398e55a862232868a6f0a7",
                     "lessThan": "e9f2517a3e18a54a3943c098d2226b245d488801",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "fs/smb/client/connect.c"
               ],
               "versions": [
                  {
                     "version": "6.12",
                     "status": "affected"
                  },
                  {
                     "version": "0",
                     "lessThan": "6.12",
                     "status": "unaffected",
                     "versionType": "semver"
                  },
                  {
                     "version": "6.6.68",
                     "lessThanOrEqual": "6.6.*",
                     "status": "unaffected",
                     "versionType": "semver"
                  },
                  {
                     "version": "6.12.7",
                     "lessThanOrEqual": "6.12.*",
                     "status": "unaffected",
                     "versionType": "semver"
                  },
                  {
                     "version": "6.13",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/906807c734ed219dcb2e7bbfde5c4168ed72a3d0"
            },
            {
               "url": "https://git.kernel.org/stable/c/127e907e11ccd54b59bb78fc22c43ccb76c71079"
            },
            {
               "url": "https://git.kernel.org/stable/c/e9f2517a3e18a54a3943c098d2226b245d488801"
            }
         ],
         "title": "smb: client: fix TCP timers deadlock after rmmod",
         "x_generator": {
            "engine": "bippy-5f407fcff5a0"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2024-54680",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}