Message-ID: <2024051955-CVE-2024-35910-5f95@gregkh>
Date: Sun, 19 May 2024 10:35:24 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-35910: tcp: properly terminate timers for kernel sockets

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tcp: properly terminate timers for kernel sockets

We had various syzbot reports about tcp timers firing after
the corresponding netns has been dismantled.

Fortunately Josef Bacik could trigger the issue more often,
and could test a patch I wrote two years ago.

When TCP sockets are closed, we call inet_csk_clear_xmit_timers()
to 'stop' the timers.

inet_csk_clear_xmit_timers() can be called from any context,
including when socket lock is held.
This is the reason it uses sk_stop_timer(), aka del_timer().
This means that ongoing timers might finish much later.

For user sockets, this is fine because each running timer
holds a reference on the socket, and the user socket holds
a reference on the netns.

For kernel sockets, we risk that the netns is freed before
timer can complete, because kernel sockets do not hold
reference on the netns.

This patch adds inet_csk_clear_xmit_timers_sync() function
that using sk_stop_timer_sync() to make sure all timers
are terminated before the kernel socket is released.
Modules using kernel sockets close them in their netns exit()
handler.

Also add sock_not_owned_by_me() helper to get LOCKDEP
support : inet_csk_clear_xmit_timers_sync() must not be called
while socket lock is held.

It is very possible we can revert in the future commit
3a58f13a881e ("net: rds: acquire refcount on TCP sockets")
which attempted to solve the issue in rds only.
(net/smc/af_smc.c and net/mptcp/subflow.c have similar code)

We probably can remove the check_net() tests from
tcp_out_of_resources() and __tcp_close() in the future.

The Linux kernel CVE team has assigned CVE-2024-35910 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.2 with commit 8a68173691f0 and fixed in 4.19.312 with commit 93f0133b9d58
	Issue introduced in 4.2 with commit 8a68173691f0 and fixed in 5.4.274 with commit 44e62f5d3567
	Issue introduced in 4.2 with commit 8a68173691f0 and fixed in 5.10.215 with commit e3e27d2b446d
	Issue introduced in 4.2 with commit 8a68173691f0 and fixed in 5.15.154 with commit 2e43d8eba6ed
	Issue introduced in 4.2 with commit 8a68173691f0 and fixed in 6.1.85 with commit 91b243de910a
	Issue introduced in 4.2 with commit 8a68173691f0 and fixed in 6.6.26 with commit c1ae4d1e76ea
	Issue introduced in 4.2 with commit 8a68173691f0 and fixed in 6.8.5 with commit 899265c1389f
	Issue introduced in 4.2 with commit 8a68173691f0 and fixed in 6.9 with commit 151c9c724d05

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-35910
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/inet_connection_sock.h
	include/net/sock.h
	net/ipv4/inet_connection_sock.c
	net/ipv4/tcp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/93f0133b9d589cc6e865f254ad9be3e9d8133f50
	https://git.kernel.org/stable/c/44e62f5d35678686734afd47c6a421ad30772e7f
	https://git.kernel.org/stable/c/e3e27d2b446deb1f643758a0c4731f5c22492810
	https://git.kernel.org/stable/c/2e43d8eba6edd1cf05a3a20fdd77688fa7ec16a4
	https://git.kernel.org/stable/c/91b243de910a9ac8476d40238ab3dbfeedd5b7de
	https://git.kernel.org/stable/c/c1ae4d1e76eacddaacb958b67cd942082f800c87
	https://git.kernel.org/stable/c/899265c1389fe022802aae73dbf13ee08837a35a
	https://git.kernel.org/stable/c/151c9c724d05d5b0dd8acd3e11cb69ef1f2dbada

Powered by blists - more mailing lists