| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2024-41006: netrom: Fix a memory leak in nr_heartbeat_expiry() |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| netrom: Fix a memory leak in nr_heartbeat_expiry() |
| |
| syzbot reported a memory leak in nr_create() [0]. |
| |
| Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.") |
| added sock_hold() to the nr_heartbeat_expiry() function, where |
| a) a socket has a SOCK_DESTROY flag or |
| b) a listening socket has a SOCK_DEAD flag. |
| |
| But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor |
| has already been closed and the nr_release() function has been called. |
| So it makes no sense to hold the reference count because no one will |
| call another nr_destroy_socket() and put it as in the case "b." |
| |
| nr_connect |
| nr_establish_data_link |
| nr_start_heartbeat |
| |
| nr_release |
| switch (nr->state) |
| case NR_STATE_3 |
| nr->state = NR_STATE_2 |
| sock_set_flag(sk, SOCK_DESTROY); |
| |
| nr_rx_frame |
| nr_process_rx_frame |
| switch (nr->state) |
| case NR_STATE_2 |
| nr_state2_machine() |
| nr_disconnect() |
| nr_sk(sk)->state = NR_STATE_0 |
| sock_set_flag(sk, SOCK_DEAD) |
| |
| nr_heartbeat_expiry |
| switch (nr->state) |
| case NR_STATE_0 |
| if (sock_flag(sk, SOCK_DESTROY) || |
| (sk->sk_state == TCP_LISTEN |
| && sock_flag(sk, SOCK_DEAD))) |
| sock_hold() // ( !!! ) |
| nr_destroy_socket() |
| |
| To fix the memory leak, let's call sock_hold() only for a listening socket. |
| |
| Found by InfoTeCS on behalf of Linux Verification Center |
| (linuxtesting.org) with Syzkaller. |
| |
| [0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16 |
| |
| The Linux kernel CVE team has assigned CVE-2024-41006 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.19.272 with commit a31caf5779ace8fa98b0d454133808e082ee7a1b and fixed in 4.19.317 with commit d616876256b38ecf9a1a1c7d674192c5346bc69c |
| Issue introduced in 5.4.231 with commit fe9b9e621cebe6b7e83f7e954c70f8bb430520e5 and fixed in 5.4.279 with commit e07a9c2a850cdebf625e7a1b8171bd23a8554313 |
| Issue introduced in 5.10.166 with commit 7de16d75b20ab13b75a7291f449a1b00090edfea and fixed in 5.10.221 with commit 5391f9db2cab5ef1cb411be1ab7dbec728078fba |
| Issue introduced in 5.15.91 with commit d2d3ab1b1de3302de2c85769121fd4f890e47ceb and fixed in 5.15.162 with commit 280cf1173726a7059b628c610c71050d5c0b6937 |
| Issue introduced in 6.1.9 with commit 51e394c6f81adbfe7c34d15f58b3d4d44f144acf and fixed in 6.1.96 with commit a02fd5d775cf9787ee7698c797e20f2fa13d2e2b |
| Issue introduced in 6.2 with commit 409db27e3a2eb5e8ef7226ca33be33361b3ed1c9 and fixed in 6.6.36 with commit b6ebe4fed73eedeb73f4540f8edc4871945474c8 |
| Issue introduced in 6.2 with commit 409db27e3a2eb5e8ef7226ca33be33361b3ed1c9 and fixed in 6.9.7 with commit d377f5a28332954b19e373d36823e59830ab1712 |
| Issue introduced in 6.2 with commit 409db27e3a2eb5e8ef7226ca33be33361b3ed1c9 and fixed in 6.10 with commit 0b9130247f3b6a1122478471ff0e014ea96bb735 |
| Issue introduced in 4.14.305 with commit e666990abb2e42dd4ba979b4706280a3664cfae7 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2024-41006 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/netrom/nr_timer.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/d616876256b38ecf9a1a1c7d674192c5346bc69c |
| https://git.kernel.org/stable/c/e07a9c2a850cdebf625e7a1b8171bd23a8554313 |
| https://git.kernel.org/stable/c/5391f9db2cab5ef1cb411be1ab7dbec728078fba |
| https://git.kernel.org/stable/c/280cf1173726a7059b628c610c71050d5c0b6937 |
| https://git.kernel.org/stable/c/a02fd5d775cf9787ee7698c797e20f2fa13d2e2b |
| https://git.kernel.org/stable/c/b6ebe4fed73eedeb73f4540f8edc4871945474c8 |
| https://git.kernel.org/stable/c/d377f5a28332954b19e373d36823e59830ab1712 |
| https://git.kernel.org/stable/c/0b9130247f3b6a1122478471ff0e014ea96bb735 |
