In the Linux kernel, the following vulnerability has been resolved:
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
syzkaller reported a use-after-free of UDP kernel socket in cleanup_bearer() without repro. 0
When bearerdisable() calls tipcudpdisable(), cleanup of the UDP kernel socket is deferred by work calling cleanupbearer().
tipcexitnet() waits for such works to finish by checking tipcnet(net)->wqcount. However, the work decrements the count too early before releasing the kernel socket, unblocking cleanup_net() and resulting in use-after-free.
Let's move the decrement after releasing the socket in cleanup_bearer().
sk_alloc+0x438/0x608
inet_create+0x4c8/0xcb0
__sock_create+0x350/0x6b8
sock_create_kern+0x58/0x78
udp_sock_create4+0x68/0x398
udp_sock_create+0x88/0xc8
tipc_udp_enable+0x5e8/0x848
__tipc_nl_bearer_enable+0x84c/0xed8
tipc_nl_bearer_enable+0x38/0x60
genl_family_rcv_msg_doit+0x170/0x248
genl_rcv_msg+0x400/0x5b0
netlink_rcv_skb+0x1dc/0x398
genl_rcv+0x44/0x68
netlink_unicast+0x678/0x8b0
netlink_sendmsg+0x5e4/0x898
____sys_sendmsg+0x500/0x830
BUG: KMSAN: use-after-free in udplibunhash+0x3b8/0x930 net/ipv4/udp.c:1979 udphashslot include/net/udp.h:85 [inline] udplibunhash+0x3b8/0x930 net/ipv4/udp.c:1979 skcommonrelease+0xaf/0x3f0 net/core/sock.c:3820 inetrelease+0x1e0/0x260 net/ipv4/afinet.c:437 inet6release+0x6f/0xd0 net/ipv6/afinet6.c:489 _sockrelease net/socket.c:658 [inline] sockrelease+0xa0/0x210 net/socket.c:686 cleanupbearer+0x42d/0x4c0 net/tipc/udpmedia.c:819 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xcaf/0x1c90 kernel/workqueue.c:3310 workerthread+0xf6c/0x1510 kernel/workqueue.c:3391 kthread+0x531/0x6b0 kernel/kthread.c:389 retfromfork+0x60/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x11/0x20 arch/x86/entry/entry_64.S:244
Uninit was created at: slabfreehook mm/slub.c:2269 [inline] slabfree mm/slub.c:4580 [inline] kmemcachefree+0x207/0xc40 mm/slub.c:4682 netfree net/core/netnamespace.c:454 [inline] cleanupnet+0x16f2/0x19d0 net/core/netnamespace.c:647 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xcaf/0x1c90 kernel/workqueue.c:3310 workerthread+0xf6c/0x1510 kernel/workqueue.c:3391 kthread+0x531/0x6b0 kernel/kthread.c:389 retfromfork+0x60/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x11/0x20 arch/x86/entry/entry64.S:244
CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: events cleanup_bearer
[
{
"id": "CVE-2024-56642-13cbb120",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "202489217765856266834392589463897364941",
"length": 476.0
},
"target": {
"file": "net/tipc/udp_media.c",
"function": "cleanup_bearer"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@650ee9a22d7a2de8999fac2d45983597a0c22359"
},
{
"id": "CVE-2024-56642-23a33759",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "202489217765856266834392589463897364941",
"length": 476.0
},
"target": {
"file": "net/tipc/udp_media.c",
"function": "cleanup_bearer"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e69457f9dfae67435f3ccf29008768eae860415"
},
{
"id": "CVE-2024-56642-24759af7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"70215025869092024429672984935405626853",
"103990991080728547110092258056063773221",
"74149602277240158380695394427025864043",
"156060732794477429610193430995926452147",
"296684470600837803934839337107644848651",
"271442362669740295805212675014550817233",
"294775489355247602719576341983764974069"
],
"threshold": 0.9
},
"target": {
"file": "net/tipc/udp_media.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a4894f238551eae178904e7f45af87577074fd"
},
{
"id": "CVE-2024-56642-2782fd79",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"70215025869092024429672984935405626853",
"103990991080728547110092258056063773221",
"74149602277240158380695394427025864043",
"156060732794477429610193430995926452147",
"296684470600837803934839337107644848651",
"271442362669740295805212675014550817233",
"294775489355247602719576341983764974069"
],
"threshold": 0.9
},
"target": {
"file": "net/tipc/udp_media.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a2fa13312e51a621f652d522d7e2df7066330b6"
},
{
"id": "CVE-2024-56642-649bd436",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "202489217765856266834392589463897364941",
"length": 476.0
},
"target": {
"file": "net/tipc/udp_media.c",
"function": "cleanup_bearer"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d00d4470bf8c4282617a3a10e76b20a9c7e4cffa"
},
{
"id": "CVE-2024-56642-83e79adc",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"70215025869092024429672984935405626853",
"103990991080728547110092258056063773221",
"74149602277240158380695394427025864043",
"156060732794477429610193430995926452147",
"296684470600837803934839337107644848651",
"271442362669740295805212675014550817233",
"294775489355247602719576341983764974069"
],
"threshold": 0.9
},
"target": {
"file": "net/tipc/udp_media.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d00d4470bf8c4282617a3a10e76b20a9c7e4cffa"
},
{
"id": "CVE-2024-56642-945d97c2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "202489217765856266834392589463897364941",
"length": 476.0
},
"target": {
"file": "net/tipc/udp_media.c",
"function": "cleanup_bearer"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a2fa13312e51a621f652d522d7e2df7066330b6"
},
{
"id": "CVE-2024-56642-a5424c8e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "202489217765856266834392589463897364941",
"length": 476.0
},
"target": {
"file": "net/tipc/udp_media.c",
"function": "cleanup_bearer"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d2a4894f238551eae178904e7f45af87577074fd"
},
{
"id": "CVE-2024-56642-b87a34ee",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"70215025869092024429672984935405626853",
"103990991080728547110092258056063773221",
"74149602277240158380695394427025864043",
"156060732794477429610193430995926452147",
"296684470600837803934839337107644848651",
"271442362669740295805212675014550817233",
"294775489355247602719576341983764974069"
],
"threshold": 0.9
},
"target": {
"file": "net/tipc/udp_media.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d62d5180c036eeac09f80660edc7a602b369125f"
},
{
"id": "CVE-2024-56642-be9ae342",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "202489217765856266834392589463897364941",
"length": 476.0
},
"target": {
"file": "net/tipc/udp_media.c",
"function": "cleanup_bearer"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d62d5180c036eeac09f80660edc7a602b369125f"
},
{
"id": "CVE-2024-56642-cf20e16b",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"70215025869092024429672984935405626853",
"103990991080728547110092258056063773221",
"74149602277240158380695394427025864043",
"156060732794477429610193430995926452147",
"296684470600837803934839337107644848651",
"271442362669740295805212675014550817233",
"294775489355247602719576341983764974069"
],
"threshold": 0.9
},
"target": {
"file": "net/tipc/udp_media.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4e69457f9dfae67435f3ccf29008768eae860415"
},
{
"id": "CVE-2024-56642-e269a0fe",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "202489217765856266834392589463897364941",
"length": 476.0
},
"target": {
"file": "net/tipc/udp_media.c",
"function": "cleanup_bearer"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e48b211c4c59062cb6dd6c2c37c51a7cc235a464"
},
{
"id": "CVE-2024-56642-fcd62f4c",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"70215025869092024429672984935405626853",
"103990991080728547110092258056063773221",
"74149602277240158380695394427025864043",
"156060732794477429610193430995926452147",
"296684470600837803934839337107644848651",
"271442362669740295805212675014550817233",
"294775489355247602719576341983764974069"
],
"threshold": 0.9
},
"target": {
"file": "net/tipc/udp_media.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@650ee9a22d7a2de8999fac2d45983597a0c22359"
},
{
"id": "CVE-2024-56642-fee76b27",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"70215025869092024429672984935405626853",
"103990991080728547110092258056063773221",
"74149602277240158380695394427025864043",
"156060732794477429610193430995926452147",
"296684470600837803934839337107644848651",
"271442362669740295805212675014550817233",
"294775489355247602719576341983764974069"
],
"threshold": 0.9
},
"target": {
"file": "net/tipc/udp_media.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e48b211c4c59062cb6dd6c2c37c51a7cc235a464"
}
]