linux-cve-announce - CVE-2024-56694: bpf: fix recursive lock when verdict program return SK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024122835-CVE-2024-56694-c701@gregkh>
Date: Sat, 28 Dec 2024 10:45:46 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-56694: bpf: fix recursive lock when verdict program return SK_PASS

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: fix recursive lock when verdict program return SK_PASS

When the stream_verdict program returns SK_PASS, it places the received skb
into its own receive queue, but a recursive lock eventually occurs, leading
to an operating system deadlock. This issue has been present since v6.9.

'''
sk_psock_strp_data_ready
    write_lock_bh(&sk->sk_callback_lock)
    strp_data_ready
      strp_read_sock
        read_sock -> tcp_read_sock
          strp_recv
            cb.rcv_msg -> sk_psock_strp_read
              # now stream_verdict return SK_PASS without peer sock assign
              __SK_PASS = sk_psock_map_verd(SK_PASS, NULL)
              sk_psock_verdict_apply
                sk_psock_skb_ingress_self
                  sk_psock_skb_ingress_enqueue
                    sk_psock_data_ready
                      read_lock_bh(&sk->sk_callback_lock) <= dead lock

'''

This topic has been discussed before, but it has not been fixed.
Previous discussion:
https://lore.kernel.org/all/6684a5864ec86_403d20898@john.notmuch

The Linux kernel CVE team has assigned CVE-2024-56694 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15.159 with commit 5965bc7535fb87510b724e5465ccc1a1cf00916d and fixed in 5.15.174 with commit 6694f7acd625ed854bf6342926e771d65dad7f69
	Issue introduced in 6.1.91 with commit 39dc9e1442385d6e9be0b6491ee488dddd55ae27 and fixed in 6.1.120 with commit 386efa339e08563dd33e83bc951aea5d407fe578
	Issue introduced in 6.6.31 with commit b397a0ab8582c533ec0c6b732392f141fc364f87 and fixed in 6.6.64 with commit da2bc8a0c8f3ac66fdf980fc59936f851a083561
	Issue introduced in 6.9 with commit 6648e613226e18897231ab5e42ffc29e63fa3365 and fixed in 6.11.11 with commit 01f1b88acfd79103da0610b45471f6c88ea98d72
	Issue introduced in 6.9 with commit 6648e613226e18897231ab5e42ffc29e63fa3365 and fixed in 6.12.2 with commit f84c5ef6ca23cc2f72f3b830d74f67944684bb05
	Issue introduced in 6.9 with commit 6648e613226e18897231ab5e42ffc29e63fa3365 and fixed in 6.13-rc1 with commit 8ca2a1eeadf09862190b2810697702d803ceef2d
	Issue introduced in 5.10.223 with commit c0809c128dad4c3413818384eb06a341633db973
	Issue introduced in 6.8.10 with commit 772d5729b5ff0df0d37b32db600ce635b2172f80

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-56694
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/core/skmsg.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/6694f7acd625ed854bf6342926e771d65dad7f69
	https://git.kernel.org/stable/c/386efa339e08563dd33e83bc951aea5d407fe578
	https://git.kernel.org/stable/c/da2bc8a0c8f3ac66fdf980fc59936f851a083561
	https://git.kernel.org/stable/c/01f1b88acfd79103da0610b45471f6c88ea98d72
	https://git.kernel.org/stable/c/f84c5ef6ca23cc2f72f3b830d74f67944684bb05
	https://git.kernel.org/stable/c/8ca2a1eeadf09862190b2810697702d803ceef2d