CVE-2024-40954
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-40954
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-40954.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-40954
- Downstream
- Related
- Published
- 2024-07-12T12:31:57Z
- Modified
- 2025-10-17T08:26:11.437223Z
- Summary
- net: do not leave a dangling sk pointer, when socket creation fails
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net: do not leave a dangling sk pointer, when socket creation fails
It is possible to trigger a use-after-free by: * attaching an fentry probe to _sockrelease() and the probe calling the bpfgetsocket_cookie() helper * running traceroute -I 1.1.1.1 on a freshly booted VM
A KASAN enabled kernel will log something like below (decoded and stripped):
BUG: KASAN: slab-use-after-free in _sockgencookie (./arch/x86/include/asm/atomic6464.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sock_diag.c:29) Read of size 8 at addr ffff888007110dd8 by task traceroute/299
CPU: 2 PID: 299 Comm: traceroute Tainted: G E 6.10.0-rc2+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Call Trace: <TASK> dumpstacklvl (lib/dumpstack.c:117 (discriminator 1)) printreport (mm/kasan/report.c:378 mm/kasan/report.c:488) ? sockgencookie (./arch/x86/include/asm/atomic6464.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sockdiag.c:29) kasanreport (mm/kasan/report.c:603) ? _sockgencookie (./arch/x86/include/asm/atomic6464.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sockdiag.c:29) kasancheckrange (mm/kasan/generic.c:183 mm/kasan/generic.c:189) _sockgencookie (./arch/x86/include/asm/atomic6464.h:15 ./include/linux/atomic/atomic-arch-fallback.h:2583 ./include/linux/atomic/atomic-instrumented.h:1611 net/core/sockdiag.c:29) bpfgetsocketptrcookie (./arch/x86/include/asm/preempt.h:94 ./include/linux/sockdiag.h:42 net/core/filter.c:5094 net/core/filter.c:5092) bpfprog875642cf11f1d139sockrelease+0x6e/0x8e bpftrampoline6442506592+0x47/0xaf _sockrelease (net/socket.c:652) _sockcreate (net/socket.c:1601) ... Allocated by task 299 on cpu 2 at 78.328492s: kasansavestack (mm/kasan/common.c:48) kasansavetrack (mm/kasan/common.c:68) _kasanslaballoc (mm/kasan/common.c:312 mm/kasan/common.c:338) kmemcacheallocnoprof (mm/slub.c:3941 mm/slub.c:4000 mm/slub.c:4007) skprotalloc (net/core/sock.c:2075) skalloc (net/core/sock.c:2134) inetcreate (net/ipv4/afinet.c:327 net/ipv4/afinet.c:252) _sockcreate (net/socket.c:1572) _syssocket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) _x64syssocket (net/socket.c:1718) dosyscall64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:130)
Freed by task 299 on cpu 2 at 78.328502s: kasansavestack (mm/kasan/common.c:48) kasansavetrack (mm/kasan/common.c:68) kasansavefreeinfo (mm/kasan/generic.c:582) poisonslabobject (mm/kasan/common.c:242) _kasanslabfree (mm/kasan/common.c:256) kmemcachefree (mm/slub.c:4437 mm/slub.c:4511) _skdestruct (net/core/sock.c:2117 net/core/sock.c:2208) inetcreate (net/ipv4/afinet.c:397 net/ipv4/afinet.c:252) _sockcreate (net/socket.c:1572) _syssocket (net/socket.c:1660 net/socket.c:1644 net/socket.c:1706) _x64syssocket (net/socket.c:1718) dosyscall64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) entrySYSCALL64afterhwframe (arch/x86/entry/entry_64.S:130)
Fix this by clearing the struct socket reference in skcommonrelease() to cover all protocol families create functions, which may already attached the reference to the sk object with sockinitdata().
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/454c454ed645fed051216b79622f7cb69c1638f5
- https://git.kernel.org/stable/c/5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9
- https://git.kernel.org/stable/c/6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2
- https://git.kernel.org/stable/c/78e4aa528a7b1204219d808310524344f627d069
- https://git.kernel.org/stable/c/893eeba94c40d513cd0fe6539330ebdaea208c0e
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc5dbb89fc2ac013afe67b9e4fcb3743c02b567cdFixed78e4aa528a7b1204219d808310524344f627d069
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc5dbb89fc2ac013afe67b9e4fcb3743c02b567cdFixed893eeba94c40d513cd0fe6539330ebdaea208c0e
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc5dbb89fc2ac013afe67b9e4fcb3743c02b567cdFixed454c454ed645fed051216b79622f7cb69c1638f5
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc5dbb89fc2ac013afe67b9e4fcb3743c02b567cdFixed5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedc5dbb89fc2ac013afe67b9e4fcb3743c02b567cdFixed6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2
Affected versions
v5.*
v6.*
Database specific
vanir_signatures
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"118127162707241639388582442609402109500",
"190323574974616632126627503805420940597",
"244971596411751733387575580773392084689"
]
},
"id": "CVE-2024-40954-0191d4f3",
"target": {
"file": "net/core/sock.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"118127162707241639388582442609402109500",
"190323574974616632126627503805420940597",
"244971596411751733387575580773392084689"
]
},
"id": "CVE-2024-40954-05c02fc0",
"target": {
"file": "net/core/sock.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"118127162707241639388582442609402109500",
"190323574974616632126627503805420940597",
"244971596411751733387575580773392084689"
]
},
"id": "CVE-2024-40954-3850c254",
"target": {
"file": "net/core/sock.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@454c454ed645fed051216b79622f7cb69c1638f5",
"deprecated": false
},
{
"digest": {
"function_hash": "97175475423273338123854814654226414491",
"length": 213.0
},
"id": "CVE-2024-40954-58d3f4c0",
"target": {
"file": "net/core/sock.c",
"function": "sk_common_release"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"118127162707241639388582442609402109500",
"190323574974616632126627503805420940597",
"150612953080481782269934273780828944076"
]
},
"id": "CVE-2024-40954-5eef032b",
"target": {
"file": "net/core/sock.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@893eeba94c40d513cd0fe6539330ebdaea208c0e",
"deprecated": false
},
{
"digest": {
"function_hash": "292501208906281347642774494312244611615",
"length": 234.0
},
"id": "CVE-2024-40954-7474f606",
"target": {
"file": "net/core/sock.c",
"function": "sk_common_release"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78e4aa528a7b1204219d808310524344f627d069",
"deprecated": false
},
{
"digest": {
"function_hash": "97175475423273338123854814654226414491",
"length": 213.0
},
"id": "CVE-2024-40954-b4a509b6",
"target": {
"file": "net/core/sock.c",
"function": "sk_common_release"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@454c454ed645fed051216b79622f7cb69c1638f5",
"deprecated": false
},
{
"digest": {
"function_hash": "292501208906281347642774494312244611615",
"length": 234.0
},
"id": "CVE-2024-40954-d113b9b0",
"target": {
"file": "net/core/sock.c",
"function": "sk_common_release"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@893eeba94c40d513cd0fe6539330ebdaea208c0e",
"deprecated": false
},
{
"digest": {
"function_hash": "97175475423273338123854814654226414491",
"length": 213.0
},
"id": "CVE-2024-40954-dd03c6d6",
"target": {
"file": "net/core/sock.c",
"function": "sk_common_release"
},
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dfe2408fd7dc4d2e7ac38a116ff0a37b1cfd3b9",
"deprecated": false
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"118127162707241639388582442609402109500",
"190323574974616632126627503805420940597",
"150612953080481782269934273780828944076"
]
},
"id": "CVE-2024-40954-fc8b8539",
"target": {
"file": "net/core/sock.c"
},
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78e4aa528a7b1204219d808310524344f627d069",
"deprecated": false
}
]