linux-cve-announce - CVE-2024-50169: vsock: Update rx_bytes on read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024110749-CVE-2024-50169-9df5@gregkh>
Date: Thu,  7 Nov 2024 10:35:09 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-50169: vsock: Update rx_bytes on read_skb()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

vsock: Update rx_bytes on read_skb()

Make sure virtio_transport_inc_rx_pkt() and virtio_transport_dec_rx_pkt()
calls are balanced (i.e. virtio_vsock_sock::rx_bytes doesn't lie) after
vsock_transport::read_skb().

While here, also inform the peer that we've freed up space and it has more
credit.

Failing to update rx_bytes after packet is dequeued leads to a warning on
SOCK_STREAM recv():

[  233.396654] rx_queue is empty, but rx_bytes is non-zero
[  233.396702] WARNING: CPU: 11 PID: 40601 at net/vmw_vsock/virtio_transport_common.c:589

The Linux kernel CVE team has assigned CVE-2024-50169 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit 634f1a7110b4 and fixed in 6.6.59 with commit 66cd51de31c6
	Issue introduced in 6.4 with commit 634f1a7110b4 and fixed in 6.11.6 with commit e5ca2b98090b
	Issue introduced in 6.4 with commit 634f1a7110b4 and fixed in 6.12-rc4 with commit 3543152f2d33

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-50169
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/vmw_vsock/virtio_transport_common.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/66cd51de31c682a311c2fa25c580b7ea45859dd9
	https://git.kernel.org/stable/c/e5ca2b98090b4bb1c393088c724af6c37812a829
	https://git.kernel.org/stable/c/3543152f2d330141d9394d28855cb90b860091d2