CVE-2024-26780
published 2024-04-04CVE-2024-26780: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC. syzbot reported a task hung; at the…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
12.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix task hung while purging oob_skb in GC.
syzbot reported a task hung; at the same time, GC was looping infinitely
in list_for_each_entry_safe() for OOB skb. [0]
syzbot demonstrated that the list_for_each_entry_safe() was not actually
safe in this case.
A single skb could have references for multiple sockets. If we free such
a skb in the list_for_each_entry_safe(), the current and next sockets could
be unlinked in a single iteration.
unix_notinflight() uses list_del_init() to unlink the socket, so the
prefetched next socket forms a loop itself and list_for_each_entry_safe()
never stops.
Here, we must use while() and make sure we always fetch the first socket.
[0]:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5065 Comm: syz-executor236 Not tainted 6.8.0-rc3-syzkaller-00136-g1f719a2f3fa6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0xd/0x60 kernel/kcov.c:207
Code: cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 14 25 40 c2 03 00 8b 05 b4 7c 78 7e a9 00 01 ff 00 48 8b 34 24 74 0f f6 c4 01 74
RSP: 0018:ffffc900033efa58 EFLAGS: 00000283
RAX: ffff88807b077800 RBX: ffff88807b077800 RCX: 1ffffffff27b1189
RDX: ffff88802a5a3b80 RSI: ffffffff8968488d RDI: ffff88807b077f70
RBP: ffffc900033efbb0 R08: 0000000000000001 R09: fffffbfff27a900c
R10: ffffffff93d48067 R11: ffffffff8ae000eb R12: ffff88807b077800
R13: dffffc0000000000 R14: ffff88807b077e40 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564f4fc1e3a8 CR3: 000000000d57a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 000000000
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.82-1 (bookworm) | linux 6.1.82-1 (bookworm) |
| linux | linux | >= 1279f9d9dec2d7462823a18c29ad61359e0a007d < 25236c91b5ab4a26a56ba2e79b8060cf4e047839 | 25236c91b5ab4a26a56ba2e79b8060cf4e047839 |
| linux | linux | >= 4fe505c63aa3273135a57597fda761e9aecc7668 < 36f7371de977f805750748e80279be7e370df85c | 36f7371de977f805750748e80279be7e370df85c |
| linux | linux | >= 6.1.78 < 6.1.81 | 6.1.81 |
| linux | linux | >= 6.6.17 < 6.6.21 | 6.6.21 |
| linux | linux | >= 6.7.5 < 6.7.9 | 6.7.9 |
| linux | linux | >= 82ae47c5c3a6b27fdc0f9e83c1499cb439c56140 < cb8890318dde26fc89c6ea67d6e9070ab50b6e91 | cb8890318dde26fc89c6ea67d6e9070ab50b6e91 |
| linux | linux | >= b74aa9ce13d02b7fd37c5325b99854f91b9b4276 < 69e0f04460f4037e01e29f0d9675544f62aafca3 | 69e0f04460f4037e01e29f0d9675544f62aafca3 |
| linux | linux | >= e0e09186d8821ad59806115d347ea32efa43ca4b < 2a3d40b4025fcfe51b04924979f1653993b17669 | 2a3d40b4025fcfe51b04924979f1653993b17669 |
| linux | linux_kernel | >= 0 < 6.1.82-1 | 6.1.82-1 |
| linux | linux_kernel | >= 0 < 6.7.9-1 | 6.7.9-1 |
| linux | linux_kernel | >= 0 < 6.7.9-1 | 6.7.9-1 |
| linux | linux_kernel | >= 6.1.78 < 6.1.81 | 6.1.81 |
| linux | linux_kernel | >= 6.6.17 < 6.6.21 | 6.6.21 |
| linux | linux_kernel | >= 6.7.5 < 6.7.9 | 6.7.9 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: af_unix: Fix task hung while purging oob_skb in GC.
vendor_redhat·2024-04-04·CVSS 5.5
CVE-2024-26780 [MEDIUM] CWE-400 kernel: af_unix: Fix task hung while purging oob_skb in GC.
kernel: af_unix: Fix task hung while purging oob_skb in GC.
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix task hung while purging oob_skb in GC.
syzbot reported a task hung; at the same time, GC was looping infinitely
in list_for_each_entry_safe() for OOB skb. [0]
syzbot demonstrated that the list_for_each_entry_safe() was not actually
safe in this case.
A single skb could have references for multiple sockets. If we free such
a skb in the list_for_each_entry_safe(), the current and next sockets could
be unlinked in a single iteration.
unix_notinflight() uses list_del_init() to unlink the socket, so the
prefetched next socket forms a loop itself and list_for_each_entry_safe()
never stops.
Here, we must use while() and make sure we always fetch the first s
Debian
CVE-2024-26780: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Fi...
vendor_debian·2024·CVSS 5.5
CVE-2024-26780 [MEDIUM] CVE-2024-26780: linux - In the Linux kernel, the following vulnerability has been resolved: af_unix: Fi...
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC. syzbot reported a task hung; at the same time, GC was looping infinitely in list_for_each_entry_safe() for OOB skb. [0] syzbot demonstrated that the list_for_each_entry_safe() was not actually safe in this case. A single skb could have references for multiple sockets. If we free such a skb in the list_for_each_entry_safe(), the current and next sockets could be unlinked in a single iteration. unix_notinflight() uses list_del_init() to unlink the socket, so the prefetched next socket forms a loop itself and list_for_each_entry_safe() never stops. Here, we must use while() and make sure we always fetch the first socket. [0]: Sending NMI from CPU 0 to CPUs 1: NMI backtrace f
GHSA
GHSA-95rc-29j2-q3vr: In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix task hung while purging oob_skb in GC
ghsa_unreviewed·2024-04-04
CVE-2024-26780 [MEDIUM] CWE-835 GHSA-95rc-29j2-q3vr: In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix task hung while purging oob_skb in GC
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix task hung while purging oob_skb in GC.
syzbot reported a task hung; at the same time, GC was looping infinitely
in list_for_each_entry_safe() for OOB skb. [0]
syzbot demonstrated that the list_for_each_entry_safe() was not actually
safe in this case.
A single skb could have references for multiple sockets. If we free such
a skb in the list_for_each_entry_safe(), the current and next sockets could
be unlinked in a single iteration.
unix_notinflight() uses list_del_init() to unlink the socket, so the
prefetched next socket forms a loop itself and list_for_each_entry_safe()
never stops.
Here, we must use while() and make sure we always fetch the first socket.
[0]:
Sending NMI from CPU 0 to CPUs 1:
NMI back
OSV
CVE-2024-26780: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC
osv·2024-04-04·CVSS 5.5
CVE-2024-26780 [MEDIUM] CVE-2024-26780: In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix task hung while purging oob_skb in GC. syzbot reported a task hung; at the same time, GC was looping infinitely in list_for_each_entry_safe() for OOB skb. [0] syzbot demonstrated that the list_for_each_entry_safe() was not actually safe in this case. A single skb could have references for multiple sockets. If we free such a skb in the list_for_each_entry_safe(), the current and next sockets could be unlinked in a single iteration. unix_notinflight() uses list_del_init() to unlink the socket, so the prefetched next socket forms a loop itself and list_for_each_entry_safe() never stops. Here, we must use while() and make sure we always fetch the first socket. [0]: Sending NMI from CPU 0 to CPUs 1: NMI backtrace f
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/25236c91b5ab4a26a56ba2e79b8060cf4e047839https://git.kernel.org/stable/c/2a3d40b4025fcfe51b04924979f1653993b17669https://git.kernel.org/stable/c/36f7371de977f805750748e80279be7e370df85chttps://git.kernel.org/stable/c/69e0f04460f4037e01e29f0d9675544f62aafca3https://git.kernel.org/stable/c/cb8890318dde26fc89c6ea67d6e9070ab50b6e91https://git.kernel.org/stable/c/25236c91b5ab4a26a56ba2e79b8060cf4e047839https://git.kernel.org/stable/c/2a3d40b4025fcfe51b04924979f1653993b17669https://git.kernel.org/stable/c/36f7371de977f805750748e80279be7e370df85chttps://git.kernel.org/stable/c/69e0f04460f4037e01e29f0d9675544f62aafca3https://git.kernel.org/stable/c/cb8890318dde26fc89c6ea67d6e9070ab50b6e91
2024-04-04
Published