In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of kernel socket in cleanupbearer(). syzkaller reported a use-after-free of UDP kernel socket in cleanupbearer() without repro. [0][1] When bearerdisable() calls tipcudpdisable(), cleanup of the UDP kernel socket is deferred by work calling cleanupbearer(). tipcnetstop() waits for such works to finish by checking tipcnet(net)->wqcount. However, the work decrements the count too early before releasing the kernel socket, unblocking cleanupnet() and resulting in use-after-free. Let's move the decrement after releasing the socket in cleanupbearer(). [0]: reftracker: net notrefcnt@000000009b3d1faf has 1/1 users at skalloc+0x438/0x608 inetcreate+0x4c8/0xcb0 sockcreate+0x350/0x6b8 sockcreatekern+0x58/0x78 udpsockcreate4+0x68/0x398 udpsockcreate+0x88/0xc8 tipcudpenable+0x5e8/0x848 _tipcnlbearerenable+0x84c/0xed8 tipcnlbearerenable+0x38/0x60 genlfamilyrcvmsgdoit+0x170/0x248 genlrcvmsg+0x400/0x5b0 netlinkrcvskb+0x1dc/0x398 genlrcv+0x44/0x68 netlinkunicast+0x678/0x8b0 netlinksendmsg+0x5e4/0x898 syssendmsg+0x500/0x830 [1]: BUG: KMSAN: use-after-free in udphashslot include/net/udp.h:85 [inline] BUG: KMSAN: use-after-free in udplibunhash+0x3b8/0x930 net/ipv4/udp.c:1979 udphashslot include/net/udp.h:85 [inline] udplibunhash+0x3b8/0x930 net/ipv4/udp.c:1979 skcommonrelease+0xaf/0x3f0 net/core/sock.c:3820 inetrelease+0x1e0/0x260 net/ipv4/afinet.c:437 inet6release+0x6f/0xd0 net/ipv6/afinet6.c:489 _sockrelease net/socket.c:658 [inline] sockrelease+0xa0/0x210 net/socket.c:686 cleanupbearer+0x42d/0x4c0 net/tipc/udpmedia.c:819 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xcaf/0x1c90 kernel/workqueue.c:3310 workerthread+0xf6c/0x1510 kernel/workqueue.c:3391 kthread+0x531/0x6b0 kernel/kthread.c:389 retfromfork+0x60/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x11/0x20 arch/x86/entry/entry64.S:244 Uninit was created at: slabfreehook mm/slub.c:2269 [inline] slabfree mm/slub.c:4580 [inline] kmemcachefree+0x207/0xc40 mm/slub.c:4682 netfree net/core/netnamespace.c:454 [inline] cleanupnet+0x16f2/0x19d0 net/core/netnamespace.c:647 processonework kernel/workqueue.c:3229 [inline] processscheduledworks+0xcaf/0x1c90 kernel/workqueue.c:3310 workerthread+0xf6c/0x1510 kernel/workqueue.c:3391 kthread+0x531/0x6b0 kernel/kthread.c:389 retfromfork+0x60/0x80 arch/x86/kernel/process.c:147 retfromforkasm+0x11/0x20 arch/x86/entry/entry64.S:244 CPU: 0 UID: 0 PID: 54 Comm: kworker/0:2 Not tainted 6.12.0-rc1-00131-gf66ebf37d69c #7 91723d6f74857f70725e1583cba3cf4adc716cfa Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Workqueue: events cleanupbearer
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_version": "3.11.0-12.19", "binary_name": "block-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "block-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "crypto-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "crypto-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "fat-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "fat-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "fb-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "firewire-core-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "floppy-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "fs-core-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "fs-core-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "fs-secondary-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "fs-secondary-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "input-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "input-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "ipmi-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "ipmi-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "irda-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "irda-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "kernel-image-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "kernel-image-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-doc" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-headers-3.11.0-12" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-headers-3.11.0-12-generic" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-headers-3.11.0-12-generic-lpae" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-image-3.11.0-12-generic" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-image-3.11.0-12-generic-lpae" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-image-extra-3.11.0-12-generic" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-libc-dev" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-source-3.11.0" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-tools-3.11.0-12" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-tools-3.11.0-12-generic" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-tools-3.11.0-12-generic-lpae" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-tools-common" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-udebs-generic" }, { "binary_version": "3.11.0-12.19", "binary_name": "linux-udebs-generic-lpae" }, { "binary_version": "3.11.0-12.19", "binary_name": "md-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "md-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "message-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "mouse-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "mouse-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "multipath-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "multipath-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nfs-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nfs-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nic-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nic-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nic-pcmcia-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nic-shared-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nic-shared-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nic-usb-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "nic-usb-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "parport-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "parport-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "pata-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "pcmcia-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "pcmcia-storage-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "plip-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "plip-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "ppp-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "ppp-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "sata-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "sata-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "scsi-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "scsi-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "serial-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "speakup-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "speakup-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "squashfs-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "squashfs-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "storage-core-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "storage-core-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "usb-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "usb-modules-3.11.0-12-generic-lpae-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "virtio-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "vlan-modules-3.11.0-12-generic-di" }, { "binary_version": "3.11.0-12.19", "binary_name": "vlan-modules-3.11.0-12-generic-lpae-di" } ] }