linux-cve-announce - CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024061956-CVE-2024-38596-f660@gregkh>
Date: Wed, 19 Jun 2024 15:46:02 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg

A data-race condition has been identified in af_unix. In one data path,
the write function unix_release_sock() atomically writes to
sk->sk_shutdown using WRITE_ONCE. However, on the reader side,
unix_stream_sendmsg() does not read it atomically. Consequently, this
issue is causing the following KCSAN splat to occur:

	BUG: KCSAN: data-race in unix_release_sock / unix_stream_sendmsg

	write (marked) to 0xffff88867256ddbb of 1 bytes by task 7270 on cpu 28:
	unix_release_sock (net/unix/af_unix.c:640)
	unix_release (net/unix/af_unix.c:1050)
	sock_close (net/socket.c:659 net/socket.c:1421)
	__fput (fs/file_table.c:422)
	__fput_sync (fs/file_table.c:508)
	__se_sys_close (fs/open.c:1559 fs/open.c:1541)
	__x64_sys_close (fs/open.c:1541)
	x64_sys_call (arch/x86/entry/syscall_64.c:33)
	do_syscall_64 (arch/x86/entry/common.c:?)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

	read to 0xffff88867256ddbb of 1 bytes by task 989 on cpu 14:
	unix_stream_sendmsg (net/unix/af_unix.c:2273)
	__sock_sendmsg (net/socket.c:730 net/socket.c:745)
	____sys_sendmsg (net/socket.c:2584)
	__sys_sendmmsg (net/socket.c:2638 net/socket.c:2724)
	__x64_sys_sendmmsg (net/socket.c:2753 net/socket.c:2750 net/socket.c:2750)
	x64_sys_call (arch/x86/entry/syscall_64.c:33)
	do_syscall_64 (arch/x86/entry/common.c:?)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

	value changed: 0x01 -> 0x03

The line numbers are related to commit dd5a440a31fa ("Linux 6.9-rc7").

Commit e1d09c2c2f57 ("af_unix: Fix data races around sk->sk_shutdown.")
addressed a comparable issue in the past regarding sk->sk_shutdown.
However, it overlooked resolving this particular data path.
This patch only offending unix_stream_sendmsg() function, since the
other reads seem to be protected by unix_state_lock() as discussed in

The Linux kernel CVE team has assigned CVE-2024-38596 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 4.19.316 with commit fca6072e1a7b
	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 5.4.278 with commit de6641d21337
	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 5.10.219 with commit 4d51845d734a
	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 5.15.161 with commit 9aa8773abfa0
	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.1.93 with commit 8299e4d778f6
	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.6.33 with commit 0688d4e499be
	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.8.12 with commit a4c88072abca
	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.9.3 with commit a52fa2addfcc
	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.10-rc1 with commit 540bf24fba16

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-38596
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/unix/af_unix.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fca6072e1a7b1e709ada5604b951513b89b4bd0a
	https://git.kernel.org/stable/c/de6641d213373fbde9bbdd7c4b552254bc9f82fe
	https://git.kernel.org/stable/c/4d51845d734a4c5d079e56e0916f936a55e15055
	https://git.kernel.org/stable/c/9aa8773abfa0e954136875b4cbf2df4cf638e8a5
	https://git.kernel.org/stable/c/8299e4d778f664b31b67cf4cf3d5409de2ecb92c
	https://git.kernel.org/stable/c/0688d4e499bee3f2749bca27329bd128686230cb
	https://git.kernel.org/stable/c/a4c88072abcaca593cefe70f90e9d3707526e8f9
	https://git.kernel.org/stable/c/a52fa2addfcccc2c5a0217fd45562605088c018b
	https://git.kernel.org/stable/c/540bf24fba16b88c1b3b9353927204b4f1074e25