CVE-2021-47304

published 2024-05-21

CVE-2021-47304: In the Linux kernel, the following vulnerability has been resolved: tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized This commit fixes a bug…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized

This commit fixes a bug (found by syzkaller) that could cause spurious
double-initializations for congestion control modules, which could cause
memory leaks or other problems for congestion control modules (like CDG)
that allocate memory in their init functions.

The buggy scenario constructed by syzkaller was something like:

(1) create a TCP socket
(2) initiate a TFO connect via sendto()
(3) while socket is in TCP_SYN_SENT, call setsockopt(TCP_CONGESTION),
which calls:
tcp_set_congestion_control() ->
tcp_reinit_congestion_control() ->
tcp_init_congestion_control()
(4) receive ACK, connection is established, call tcp_init_transfer(),
set icsk_ca_initialized=0 (without first calling cc->release()),
call tcp_init_congestion_control() again.

Note that in this sequence tcp_init_congestion_control() is called
twice without a cc->release() call in between. Thus, for CC modules
that allocate memory in their init() function, e.g, CDG, a memory leak
may occur. The syzkaller tool managed to find a reproducer that
triggered such a leak in CDG.

The bug was introduced when that commit 8919a9b31eb4 ("tcp: Only init
congestion control if not initialized already")
introduced icsk_ca_initialized and set icsk_ca_initialized to 0 in
tcp_init_transfer(), missing the possibility for a sequence like the
one above, where a process could call setsockopt(TCP_CONGESTION) in
state TCP_SYN_SENT (i.e. after the connect() or TFO open sendmsg()),
which would call tcp_init_congestion_control(). It did not intend to
reset any initialization that the user had already explicitly made;
it just missed the possibility of that particular sequence (which
syzkaller managed to find).

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.14.6-1 (bookworm)	linux 5.14.6-1 (bookworm)
linux	linux	—	—
linux	linux	>= 8919a9b31eb4fb4c0a93e5fb350a626924302aa6 < ad4ba3404931745a5977ad12db4f0c34080e52f7	ad4ba3404931745a5977ad12db4f0c34080e52f7
linux	linux	>= 8919a9b31eb4fb4c0a93e5fb350a626924302aa6 < fe77b85828ca9ddc42977b79de9e40d18545b4fe	fe77b85828ca9ddc42977b79de9e40d18545b4fe
linux	linux	>= 8919a9b31eb4fb4c0a93e5fb350a626924302aa6 < be5d1b61a2ad28c7e57fe8bfa277373e8ecffcdc	be5d1b61a2ad28c7e57fe8bfa277373e8ecffcdc
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.70-1	5.10.70-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	>= 0 < 5.14.6-1	5.14.6-1
linux	linux_kernel	>= 5.10 < 5.10.53	5.10.53
linux	linux_kernel	>= 5.11 < 5.13.5	5.13.5

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-415 CWE-402