CVE-2024-26741
published 2024-04-03CVE-2024-26741: In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). syzkaller…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.27%
19.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().
syzkaller reported a warning [0] in inet_csk_destroy_sock() with no
repro.
WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
However, the syzkaller's log hinted that connect() failed just before
the warning due to FAULT_INJECTION. [1]
When connect() is called for an unbound socket, we search for an
available ephemeral port. If a bhash bucket exists for the port, we
call __inet_check_established() or __inet6_check_established() to check
if the bucket is reusable.
If reusable, we add the socket into ehash and set inet_sk(sk)->inet_num.
Later, we look up the corresponding bhash2 bucket and try to allocate
it if it does not exist.
Although it rarely occurs in real use, if the allocation fails, we must
revert the changes by check_established(). Otherwise, an unconnected
socket could illegally occupy an ehash entry.
Note that we do not put tw back into ehash because sk might have
already responded to a packet for tw and it would be better to free
tw earlier under such memory presure.
[0]:
WARNING: CPU: 0 PID: 350830 at net/ipv4/inet_connection_sock.c:1193 inet_csk_destroy_sock (net/ipv4/inet_connection_sock.c:1193)
Modules linked in:
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
RIP: 0010:inet_csk_destroy_sock (net/ipv4/inet_connection_sock.c:1193)
Code: 41 5c 41 5d 41 5e e9 2d 4a 3d fd e8 28 4a 3d fd 48 89 ef e8 f0 cd 7d ff 5b 5d 41 5c 41 5d 41 5e e9 13 4a 3d fd e8 0e 4a 3d fd 0b e9 61 fe ff ff e8 02 4a 3d fd 4c 89 e7 be 03 00 00 00 e8 05
RSP: 0018:ffffc9000b21fd38 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000009e78 RCX: ffffffff840bae40
RDX: ffff88806e46c600 RSI: ffffffff840bb012 RDI: ffff88811755cca8
RBP: ffff88811755c880 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000009e78 R11: 0000000000000000 R12: ffff888
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.82-1 (bookworm) | linux 6.1.82-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 28044fc1d4953b07acec0da4d2fc4784c57ea6fb < 729bc77af438a6e67914c97f6f3d3af8f72c0131 | 729bc77af438a6e67914c97f6f3d3af8f72c0131 |
| linux | linux | >= 28044fc1d4953b07acec0da4d2fc4784c57ea6fb < 334a8348b2df26526f3298848ad6864285592caf | 334a8348b2df26526f3298848ad6864285592caf |
| linux | linux | >= 28044fc1d4953b07acec0da4d2fc4784c57ea6fb < f8c4a6b850882bc47aaa864b720c7a2ee3102f39 | f8c4a6b850882bc47aaa864b720c7a2ee3102f39 |
| linux | linux | >= 28044fc1d4953b07acec0da4d2fc4784c57ea6fb < 66b60b0c8c4a163b022a9f0ad6769b0fd3dc662f | 66b60b0c8c4a163b022a9f0ad6769b0fd3dc662f |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.82-1 | 6.1.82-1 |
| linux | linux_kernel | >= 0 < 6.7.7-1 | 6.7.7-1 |
| linux | linux_kernel | >= 0 < 6.7.7-1 | 6.7.7-1 |
| linux | linux_kernel | >= 6.1 < 6.1.80 | 6.1.80 |
| linux | linux_kernel | >= 6.2 < 6.6.19 | 6.6.19 |
| linux | linux_kernel | >= 6.7 < 6.7.7 | 6.7.7 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().
vendor_redhat·2024-04-03·CVSS 5.5
CVE-2024-26741 [MEDIUM] CWE-459 kernel: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().
kernel: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().
In the Linux kernel, the following vulnerability has been resolved:
dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().
syzkaller reported a warning [0] in inet_csk_destroy_sock() with no
repro.
WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
However, the syzkaller's log hinted that connect() failed just before
the warning due to FAULT_INJECTION. [1]
When connect() is called for an unbound socket, we search for an
available ephemeral port. If a bhash bucket exists for the port, we
call __inet_check_established() or __inet6_check_established() to check
if the bucket is reusable.
If reusable, we add the socket into ehash and set inet_sk(sk)->inet_num.
Later,
Debian
CVE-2024-26741: linux - In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: U...
vendor_debian·2024·CVSS 5.5
CVE-2024-26741 [MEDIUM] CVE-2024-26741: linux - In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: U...
In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). syzkaller reported a warning [0] in inet_csk_destroy_sock() with no repro. WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash); However, the syzkaller's log hinted that connect() failed just before the warning due to FAULT_INJECTION. [1] When connect() is called for an unbound socket, we search for an available ephemeral port. If a bhash bucket exists for the port, we call __inet_check_established() or __inet6_check_established() to check if the bucket is reusable. If reusable, we add the socket into ehash and set inet_sk(sk)->inet_num. Later, we look up the corresponding bhash2 bucket and try to allocate it if it does not exist. A
OSV
CVE-2024-26741: In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished()
osv·2024-04-03·CVSS 5.5
CVE-2024-26741 [MEDIUM] CVE-2024-26741: In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished()
In the Linux kernel, the following vulnerability has been resolved: dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished(). syzkaller reported a warning [0] in inet_csk_destroy_sock() with no repro. WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash); However, the syzkaller's log hinted that connect() failed just before the warning due to FAULT_INJECTION. [1] When connect() is called for an unbound socket, we search for an available ephemeral port. If a bhash bucket exists for the port, we call __inet_check_established() or __inet6_check_established() to check if the bucket is reusable. If reusable, we add the socket into ehash and set inet_sk(sk)->inet_num. Later, we look up the corresponding bhash2 bucket and try to allocate it if it does not exist. A
GHSA
GHSA-x4x7-9mj3-h6gw: In the Linux kernel, the following vulnerability has been resolved:
dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished()
ghsa_unreviewed·2024-04-03
CVE-2024-26741 [MEDIUM] CWE-770 GHSA-x4x7-9mj3-h6gw: In the Linux kernel, the following vulnerability has been resolved:
dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished()
In the Linux kernel, the following vulnerability has been resolved:
dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check_estalblished().
syzkaller reported a warning [0] in inet_csk_destroy_sock() with no
repro.
WARN_ON(inet_sk(sk)->inet_num && !inet_csk(sk)->icsk_bind_hash);
However, the syzkaller's log hinted that connect() failed just before
the warning due to FAULT_INJECTION. [1]
When connect() is called for an unbound socket, we search for an
available ephemeral port. If a bhash bucket exists for the port, we
call __inet_check_established() or __inet6_check_established() to check
if the bucket is reusable.
If reusable, we add the socket into ehash and set inet_sk(sk)->inet_num.
Later, we look up the corresponding bhash2 bucket and try to allocate
it if it does not e
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/334a8348b2df26526f3298848ad6864285592cafhttps://git.kernel.org/stable/c/66b60b0c8c4a163b022a9f0ad6769b0fd3dc662fhttps://git.kernel.org/stable/c/729bc77af438a6e67914c97f6f3d3af8f72c0131https://git.kernel.org/stable/c/f8c4a6b850882bc47aaa864b720c7a2ee3102f39https://git.kernel.org/stable/c/334a8348b2df26526f3298848ad6864285592cafhttps://git.kernel.org/stable/c/66b60b0c8c4a163b022a9f0ad6769b0fd3dc662fhttps://git.kernel.org/stable/c/729bc77af438a6e67914c97f6f3d3af8f72c0131https://git.kernel.org/stable/c/f8c4a6b850882bc47aaa864b720c7a2ee3102f39
2024-04-03
Published