cbcvebase.
CVE-2024-50154
published 2024-11-07

CVE-2024-50154: In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported…

PriorityP433high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.24%
15.1th percentile
In the Linux kernel, the following vulnerability has been resolved: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler(). """ We are seeing a use-after-free from a bpf prog attached to trace_tcp_retransmit_synack. The program passes the req->sk to the bpf_sk_storage_get_tracing kernel helper which does check for null before using it. """ The commit 83fccfc3940c ("inet: fix potential deadlock in reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not to call del_timer_sync() from reqsk_timer_handler(), but it introduced a small race window. Before the timer is called, expire_timers() calls detach_timer(timer, true) to clear timer->entry.pprev and marks it as not pending. If reqsk_queue_unlink() checks timer_pending() just after expire_timers() calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will continue running and send multiple SYN+ACKs until it expires. The reported UAF could happen if req->sk is close()d earlier than the timer expiration, which is 63s by default. The scenario would be 1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(), but del_timer_sync() is missed 2. reqsk timer is executed and scheduled again 3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but reqsk timer still has another one, and inet_csk_accept() does not clear req->sk for non-TFO sockets 4. sk is close()d 5. reqsk timer is executed again, and BPF touches req->sk Let's not use timer_pending() by passing the caller context to __inet_csk_reqsk_queue_drop(). Note that reqsk timer is pinned, so the issue does not happen in most use cases. [1] [0] BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0 Use-after-free read at 0x00000000a891fb3a (in kfence-#1): bpf_sk_storage_get_tracing+0x2e/0x1b0 bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda bpf_trace_run2+0x4c/0xc0 tcp_rtx_synack+0xf9/0x100 reqsk_t

Affected

31 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.115-1 (bookworm)linux 6.1.115-1 (bookworm)
debianlinux-6.1< linux 6.1.115-1 (bookworm)linux 6.1.115-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux>= 4.1.11 < 4.24.2
linuxlinux>= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 106e457953315e476b3642ef24be25ed862aaba3106e457953315e476b3642ef24be25ed862aaba3
linuxlinux>= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < c964bf65f80a14288d767023a1b300b30f5b9cd0c964bf65f80a14288d767023a1b300b30f5b9cd0
linuxlinux>= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 8459d61fbf24967839a70235165673148c7c7f178459d61fbf24967839a70235165673148c7c7f17
linuxlinux>= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 5071beb59ee416e8ab456ac8647a4dabcda823b15071beb59ee416e8ab456ac8647a4dabcda823b1
linuxlinux>= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 997ae8da14f1639ce6fb66a063dab54031cd61b3997ae8da14f1639ce6fb66a063dab54031cd61b3
linuxlinux>= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 51e34db64f4e43c7b055ccf881b7f3e0c31bb26d51e34db64f4e43c7b055ccf881b7f3e0c31bb26d
linuxlinux>= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < e8c526f2bdf1845bedaf6a478816a3d06fa78b8fe8c526f2bdf1845bedaf6a478816a3d06fa78b8f
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.237-15.10.237-1
linuxlinux_kernel>= 0 < 6.1.115-16.1.115-1
linuxlinux_kernel>= 0 < 6.11.6-16.11.6-1
linuxlinux_kernel>= 0 < 6.11.6-16.11.6-1
linuxlinux_kernel>= 0 < 5.15.0-133.1445.15.0-133.144
linuxlinux_kernel>= 0 < 6.8.0-58.606.8.0-58.60
linuxlinux_kernel>= 0 < 6.11.0-18.186.11.0-18.18
linuxlinux_kernel>= 4.1.11 < 4.24.2
linuxlinux_kernel>= 4.2 < 5.15.1705.15.170
linuxlinux_kernel>= 5.16 < 6.1.1156.1.115
linuxlinux_kernel>= 6.2 < 6.6.596.6.59
linuxlinux_kernel>= 6.7 < 6.11.66.11.6

CVSS provenance

nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.0HIGH
vendor_msrc7.0HIGH
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.