CVE-2024-26923

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-26923
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26923.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-26923
Aliases
Downstream
Related
Published
2024-04-24T21:49:22.001Z
Modified
2026-03-20T12:35:18.457953Z
Summary
af_unix: Fix garbage collector racing against connect()
Details

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix garbage collector racing against connect()

Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCMRIGHTS, two consecutive passes of scanchildren() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gcinflightlist.

sockets are AFUNIX/SOCKSTREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped

connect(S, addr) sendmsg(S, [V]); close(V) _unixgc() ---------------- ------------------------- -----------

NS = unixcreate1() skb1 = sockwmalloc(NS) L = unixfindother(addr) unixstatelock(L) unix_peer(S) = NS // V count=1 inflight=0

        NS = unix_peer(S)
        skb2 = sock_alloc()
        skb_queue_tail(NS, skb2[V])

        // V became in-flight
        // V count=2 inflight=1

        close(V)

        // V count=1 inflight=1
        // GC candidate condition met

                    for u in gc_inflight_list:
                      if (total_refs == inflight_refs)
                        add u to gc_candidates

                    // gc_candidates={L, V}

                    for u in gc_candidates:
                      scan_children(u, dec_inflight)

                    // embryo (skb1) was not
                    // reachable from L yet, so V's
                    // inflight remains unchanged

_skbqueuetail(L, skb1) unixstateunlock(L) for u in gccandidates: if (u.inflight) scanchildren(u, incinflightmovetail)

                    // V count=1 inflight=2 (!)

If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCMRIGHTS. At this point, unixinflight() can not happen because unixgclock is already taken. Inflight graph remains unaffected.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26923.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1fd05ba5a2f2aa8e7b9b52ef55df850e2e7d54c9
Fixed
a36ae0ec2353015f0f6762e59f4c2dbc0c906423
Fixed
343c5372d5e17b306db5f8f3c895539b06e3177f
Fixed
2e2a03787f4f0abc0072350654ab0ef3324d9db3
Fixed
e76c2678228f6aec74b305ae30c9374cc2f28a51
Fixed
b75722be422c276b699200de90527d01c602ea7c
Fixed
507cc232ffe53a352847893f8177d276c3b532a9
Fixed
dbdf7bec5c920200077d693193f989cb1513f009
Fixed
47d8ac011fe1c9251070e1bd64cb10b48193ec51

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26923.json"