Upstream information

CVE-2024-50154 at MITRE

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

Martin KaFai Lau reported use-after-free [0] in reqsk_timer_handler().

"""
We are seeing a use-after-free from a bpf prog attached to
trace_tcp_retransmit_synack. The program passes the req->sk to the
bpf_sk_storage_get_tracing kernel helper which does check for null
before using it.
"""

The commit 83fccfc3940c ("inet: fix potential deadlock in
reqsk_queue_unlink()") added timer_pending() in reqsk_queue_unlink() not
to call del_timer_sync() from reqsk_timer_handler(), but it introduced a
small race window.

Before the timer is called, expire_timers() calls detach_timer(timer, true)
to clear timer->entry.pprev and marks it as not pending.

If reqsk_queue_unlink() checks timer_pending() just after expire_timers()
calls detach_timer(), TCP will miss del_timer_sync(); the reqsk timer will
continue running and send multiple SYN+ACKs until it expires.

The reported UAF could happen if req->sk is close()d earlier than the timer
expiration, which is 63s by default.

The scenario would be

1. inet_csk_complete_hashdance() calls inet_csk_reqsk_queue_drop(),
but del_timer_sync() is missed

2. reqsk timer is executed and scheduled again

3. req->sk is accept()ed and reqsk_put() decrements rsk_refcnt, but
reqsk timer still has another one, and inet_csk_accept() does not
clear req->sk for non-TFO sockets

4. sk is close()d

5. reqsk timer is executed again, and BPF touches req->sk

Let's not use timer_pending() by passing the caller context to
__inet_csk_reqsk_queue_drop().

Note that reqsk timer is pinned, so the issue does not happen in most
use cases. [1]

[0]
BUG: KFENCE: use-after-free read in bpf_sk_storage_get_tracing+0x2e/0x1b0

Use-after-free read at 0x00000000a891fb3a (in kfence-#1):
bpf_sk_storage_get_tracing+0x2e/0x1b0
bpf_prog_5ea3e95db6da0438_tcp_retransmit_synack+0x1d20/0x1dda
bpf_trace_run2+0x4c/0xc0
tcp_rtx_synack+0xf9/0x100
reqsk_timer_handler+0xda/0x3d0
run_timer_softirq+0x292/0x8a0
irq_exit_rcu+0xf5/0x320
sysvec_apic_timer_interrupt+0x6d/0x80
asm_sysvec_apic_timer_interrupt+0x16/0x20
intel_idle_irq+0x5a/0xa0
cpuidle_enter_state+0x94/0x273
cpu_startup_entry+0x15e/0x260
start_secondary+0x8a/0x90
secondary_startup_64_no_verify+0xfa/0xfb

kfence-#1: 0x00000000a72cc7b6-0x00000000d97616d9, size=2376, cache=TCPv6

allocated by task 0 on cpu 9 at 260507.901592s:
sk_prot_alloc+0x35/0x140
sk_clone_lock+0x1f/0x3f0
inet_csk_clone_lock+0x15/0x160
tcp_create_openreq_child+0x1f/0x410
tcp_v6_syn_recv_sock+0x1da/0x700
tcp_check_req+0x1fb/0x510
tcp_v6_rcv+0x98b/0x1420
ipv6_list_rcv+0x2258/0x26e0
napi_complete_done+0x5b1/0x2990
mlx5e_napi_poll+0x2ae/0x8d0
net_rx_action+0x13e/0x590
irq_exit_rcu+0xf5/0x320
common_interrupt+0x80/0x90
asm_common_interrupt+0x22/0x40
cpuidle_enter_state+0xfb/0x273
cpu_startup_entry+0x15e/0x260
start_secondary+0x8a/0x90
secondary_startup_64_no_verify+0xfa/0xfb

freed by task 0 on cpu 9 at 260507.927527s:
rcu_core_si+0x4ff/0xf10
irq_exit_rcu+0xf5/0x320
sysvec_apic_timer_interrupt+0x6d/0x80
asm_sysvec_apic_timer_interrupt+0x16/0x20
cpuidle_enter_state+0xfb/0x273
cpu_startup_entry+0x15e/0x260
start_secondary+0x8a/0x90
secondary_startup_64_no_verify+0xfa/0xfb

SUSE information

Overall state of this security issue: Pending

This issue is currently rated as having important severity.

CVSS v3 Scores
  National Vulnerability Database SUSE
Base Score 7 7
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local Local
Attack Complexity High High
Privileges Required Low Low
User Interaction None None
Scope Unchanged Unchanged
Confidentiality Impact High High
Integrity Impact High High
Availability Impact High High
CVSSv3 Version 3.1 3.1
CVSS v4 Scores
  SUSE
Base Score 7.3
Vector CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attack Vector Local
Attack Complexity High
Attack Requirements Present
Privileges Required Low
User Interaction None
Vulnerable System Confidentiality Impact High
Vulnerable System Integrity Impact High
Vulnerable System Availability Impact High
Subsequent System Confidentiality Impact None
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
CVSSv4 Version 4.0
SUSE Bugzilla entries: 1233070 [IN_PROGRESS], 1233072 [NEW]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE Tumbleweed
  • kernel-devel >= 6.11.8-1.1
  • kernel-macros >= 6.11.8-1.1
  • kernel-source >= 6.11.8-1.1
  • kernel-source-vanilla >= 6.11.8-1.1
Patchnames:
openSUSE-Tumbleweed-2024-14500


Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.

Product(s) Source package State
Products under general support and receiving all security fixes.
SUSE Linux Enterprise Desktop 15 SP5 kernel-default Affected
SUSE Linux Enterprise Desktop 15 SP5 kernel-source Affected
SUSE Linux Enterprise Desktop 15 SP6 kernel-default Affected
SUSE Linux Enterprise Desktop 15 SP6 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP5 kernel-default Affected
SUSE Linux Enterprise High Performance Computing 15 SP5 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP5 kernel-source-azure Affected
SUSE Linux Enterprise High Performance Computing 15 SP6 kernel-default Affected
SUSE Linux Enterprise High Performance Computing 15 SP6 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP6 kernel-source-azure Affected
SUSE Linux Enterprise Live Patching 15 SP5 kernel-default Affected
SUSE Linux Enterprise Live Patching 15 SP5 kernel-source Affected
SUSE Linux Enterprise Live Patching 15 SP6 kernel-default Affected
SUSE Linux Enterprise Live Patching 15 SP6 kernel-source Affected
SUSE Linux Enterprise Micro 5.1 kernel-default Affected
SUSE Linux Enterprise Micro 5.1 kernel-rt Affected
SUSE Linux Enterprise Micro 5.1 kernel-source Affected
SUSE Linux Enterprise Micro 5.1 kernel-source-rt Affected
SUSE Linux Enterprise Micro 5.2 kernel-default Affected
SUSE Linux Enterprise Micro 5.2 kernel-rt Affected
SUSE Linux Enterprise Micro 5.2 kernel-source Affected
SUSE Linux Enterprise Micro 5.2 kernel-source-rt Affected
SUSE Linux Enterprise Micro 5.3 kernel-default Affected
SUSE Linux Enterprise Micro 5.3 kernel-rt Affected
SUSE Linux Enterprise Micro 5.3 kernel-source Affected
SUSE Linux Enterprise Micro 5.3 kernel-source-rt Affected
SUSE Linux Enterprise Micro 5.4 kernel-default Affected
SUSE Linux Enterprise Micro 5.4 kernel-rt Affected
SUSE Linux Enterprise Micro 5.4 kernel-source Affected
SUSE Linux Enterprise Micro 5.4 kernel-source-rt Affected
SUSE Linux Enterprise Micro 5.5 kernel-default Affected
SUSE Linux Enterprise Micro 5.5 kernel-source Affected
SUSE Linux Enterprise Micro 5.5 kernel-source-rt Affected
SUSE Linux Enterprise Micro 6.0 kernel-default Affected
SUSE Linux Enterprise Micro 6.0 kernel-source Affected
SUSE Linux Enterprise Micro 6.0 kernel-source-rt Affected
SUSE Linux Enterprise Module for Basesystem 15 SP5 kernel-default Affected
SUSE Linux Enterprise Module for Basesystem 15 SP5 kernel-source Affected
SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-default Affected
SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-source Affected
SUSE Linux Enterprise Module for Development Tools 15 SP5 kernel-default Affected
SUSE Linux Enterprise Module for Development Tools 15 SP5 kernel-source Affected
SUSE Linux Enterprise Module for Development Tools 15 SP6 kernel-default Affected
SUSE Linux Enterprise Module for Development Tools 15 SP6 kernel-source Affected
SUSE Linux Enterprise Module for Public Cloud 15 SP5 kernel-source-azure Affected
SUSE Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure Affected
SUSE Linux Enterprise Real Time 15 SP5 kernel-source-rt Affected
SUSE Linux Enterprise Real Time 15 SP6 kernel-source-rt Affected
SUSE Linux Enterprise Server 15 SP5 kernel-default Affected
SUSE Linux Enterprise Server 15 SP5 kernel-source Affected
SUSE Linux Enterprise Server 15 SP5 kernel-source-azure Affected
SUSE Linux Enterprise Server 15 SP6 kernel-default Affected
SUSE Linux Enterprise Server 15 SP6 kernel-source Affected
SUSE Linux Enterprise Server 15 SP6 kernel-source-azure Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-default Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-source-azure Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-default Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6 kernel-source-azure Affected
SUSE Manager Proxy 4.3 kernel-default Affected
SUSE Manager Proxy 4.3 kernel-source Affected
SUSE Manager Retail Branch Server 4.3 kernel-default Affected
SUSE Manager Retail Branch Server 4.3 kernel-source Affected
SUSE Manager Server 4.3 kernel-default Affected
SUSE Manager Server 4.3 kernel-source Affected
SUSE Real Time Module 15 SP5 kernel-source-rt Affected
SUSE Real Time Module 15 SP6 kernel-source-rt Affected
openSUSE Leap 15.5 kernel-default Affected
openSUSE Leap 15.5 kernel-source Affected
openSUSE Leap 15.5 kernel-source-azure Affected
openSUSE Leap 15.5 kernel-source-rt Affected
openSUSE Leap 15.6 kernel-default Affected
openSUSE Leap 15.6 kernel-source Affected
openSUSE Leap 15.6 kernel-source-azure Affected
openSUSE Leap 15.6 kernel-source-rt Affected
Products under Long Term Service Pack support and receiving important and critical security fixes.
SUSE Linux Enterprise Desktop 15 SP4 kernel-source Affected
SUSE Linux Enterprise High Availability Extension 12 SP5 kernel-default Affected
SUSE Linux Enterprise High Availability Extension 12 SP5 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 12 SP5 kernel-default Affected
SUSE Linux Enterprise High Performance Computing 12 SP5 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 12 SP5 kernel-source-azure Affected
SUSE Linux Enterprise High Performance Computing 15 SP2 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kernel-default Affected
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP3 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default Affected
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP4 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS kernel-default Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-default Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-source Affected
SUSE Linux Enterprise Live Patching 12 SP5 kernel-default Affected
SUSE Linux Enterprise Live Patching 12 SP5 kernel-source Affected
SUSE Linux Enterprise Live Patching 15 SP2 kernel-default Affected
SUSE Linux Enterprise Live Patching 15 SP2 kernel-source Affected
SUSE Linux Enterprise Live Patching 15 SP3 kernel-default Affected
SUSE Linux Enterprise Live Patching 15 SP3 kernel-source Affected
SUSE Linux Enterprise Live Patching 15 SP4 kernel-default Affected
SUSE Linux Enterprise Live Patching 15 SP4 kernel-source Affected
SUSE Linux Enterprise Module for Basesystem 15 SP2 kernel-source Affected
SUSE Linux Enterprise Module for Basesystem 15 SP3 kernel-source Affected
SUSE Linux Enterprise Module for Basesystem 15 SP4 kernel-source Affected
SUSE Linux Enterprise Module for Development Tools 15 SP2 kernel-source Affected
SUSE Linux Enterprise Module for Development Tools 15 SP3 kernel-source Affected
SUSE Linux Enterprise Module for Development Tools 15 SP4 kernel-source Affected
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default Not affected
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-source Not affected
SUSE Linux Enterprise Server 12 SP5 kernel-default Affected
SUSE Linux Enterprise Server 12 SP5 kernel-source Affected
SUSE Linux Enterprise Server 12 SP5 kernel-source-azure Affected
SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default Affected
SUSE Linux Enterprise Server 12 SP5-LTSS kernel-source Affected
SUSE Linux Enterprise Server 12 SP5-LTSS kernel-source-azure Affected
SUSE Linux Enterprise Server 15 SP2 kernel-source Affected
SUSE Linux Enterprise Server 15 SP2-LTSS kernel-default Affected
SUSE Linux Enterprise Server 15 SP2-LTSS kernel-source Affected
SUSE Linux Enterprise Server 15 SP3 kernel-source Affected
SUSE Linux Enterprise Server 15 SP3-LTSS kernel-default Affected
SUSE Linux Enterprise Server 15 SP3-LTSS kernel-source Affected
SUSE Linux Enterprise Server 15 SP4 kernel-source Affected
SUSE Linux Enterprise Server 15 SP4-LTSS kernel-default Affected
SUSE Linux Enterprise Server 15 SP4-LTSS kernel-source Affected
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 kernel-source Affected
SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 kernel-source-azure Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP5 kernel-default Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP5 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP5 kernel-source-azure Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP2 kernel-default Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP2 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-default Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-default Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-source Affected
Products past their end of life and not receiving proactive updates anymore.
HPE Helion OpenStack 8 kernel-source Affected
SUSE CaaS Platform 4.0 kernel-source Affected
SUSE CaaS Platform Toolchain 3 kernel-source Affected
SUSE Enterprise Storage 6 kernel-source Affected
SUSE Enterprise Storage 7 kernel-source Affected
SUSE Enterprise Storage 7.1 kernel-source Affected
SUSE Linux Enterprise Desktop 11 SP4 kernel-source Not affected
SUSE Linux Enterprise Desktop 12 SP1 kernel-source Unsupported
SUSE Linux Enterprise Desktop 12 SP2 kernel-source Affected
SUSE Linux Enterprise Desktop 12 SP3 kernel-source Affected
SUSE Linux Enterprise Desktop 12 SP4 kernel-source Affected
SUSE Linux Enterprise Desktop 15 kernel-source Affected
SUSE Linux Enterprise Desktop 15 SP1 kernel-source Affected
SUSE Linux Enterprise Desktop 15 SP2 kernel-source Affected
SUSE Linux Enterprise Desktop 15 SP3 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP1 kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15-ESPOS kernel-source Affected
SUSE Linux Enterprise High Performance Computing 15-LTSS kernel-source Affected
SUSE Linux Enterprise Micro 5.0 kernel-default Affected
SUSE Linux Enterprise Module for Basesystem 15 kernel-source Affected
SUSE Linux Enterprise Module for Basesystem 15 SP1 kernel-source Affected
SUSE Linux Enterprise Module for Development Tools 15 kernel-source Affected
SUSE Linux Enterprise Module for Development Tools 15 SP1 kernel-source Affected
SUSE Linux Enterprise Point of Sale 12 SP2-CLIENT kernel-source Affected
SUSE Linux Enterprise Real Time 12 SP5 kernel-source-rt Affected
SUSE Linux Enterprise Real Time 15 SP2 kernel-source Affected
SUSE Linux Enterprise Real Time 15 SP3 kernel-source Affected
SUSE Linux Enterprise Real Time 15 SP3 kernel-source-rt Affected
SUSE Linux Enterprise Real Time 15 SP4 kernel-source Affected
SUSE Linux Enterprise Real Time 15 SP4 kernel-source-rt Affected
SUSE Linux Enterprise Server 11 SP4 kernel-source Not affected
SUSE Linux Enterprise Server 11 SP4 LTSS kernel-default Not affected
SUSE Linux Enterprise Server 11 SP4 LTSS kernel-source Not affected
SUSE Linux Enterprise Server 11 SP4-LTSS kernel-source Not affected
SUSE Linux Enterprise Server 12 SP1 kernel-source Unsupported
SUSE Linux Enterprise Server 12 SP1-LTSS kernel-source Unsupported
SUSE Linux Enterprise Server 12 SP2 kernel-source Affected
SUSE Linux Enterprise Server 12 SP2-BCL kernel-source Affected
SUSE Linux Enterprise Server 12 SP2-ESPOS kernel-source Affected
SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default Affected
SUSE Linux Enterprise Server 12 SP2-LTSS kernel-source Affected
SUSE Linux Enterprise Server 12 SP3 kernel-source Affected
SUSE Linux Enterprise Server 12 SP3-BCL kernel-source Affected
SUSE Linux Enterprise Server 12 SP3-ESPOS kernel-source Affected
SUSE Linux Enterprise Server 12 SP3-LTSS kernel-source Affected
SUSE Linux Enterprise Server 12 SP4 kernel-source Affected
SUSE Linux Enterprise Server 12 SP4-ESPOS kernel-source Affected
SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default Affected
SUSE Linux Enterprise Server 12 SP4-LTSS kernel-source Affected
SUSE Linux Enterprise Server 15 kernel-source Affected
SUSE Linux Enterprise Server 15 SP1 kernel-source Affected
SUSE Linux Enterprise Server 15 SP1-BCL kernel-source Affected
SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default Affected
SUSE Linux Enterprise Server 15 SP1-LTSS kernel-source Affected
SUSE Linux Enterprise Server 15 SP2-BCL kernel-source Affected
SUSE Linux Enterprise Server 15 SP3-BCL kernel-source Affected
SUSE Linux Enterprise Server 15-LTSS kernel-default Affected
SUSE Linux Enterprise Server 15-LTSS kernel-source Affected
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP1 kernel-source Unsupported
SUSE Linux Enterprise Server for SAP Applications 12 SP2 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP3 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 12 SP4 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 15 kernel-source Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP1 kernel-source Affected
SUSE Manager Proxy 4.0 kernel-source Affected
SUSE Manager Proxy 4.1 kernel-source Affected
SUSE Manager Proxy 4.2 kernel-source Affected
SUSE Manager Retail Branch Server 4.0 kernel-source Affected
SUSE Manager Retail Branch Server 4.1 kernel-source Affected
SUSE Manager Retail Branch Server 4.2 kernel-source Affected
SUSE Manager Server 4.0 kernel-source Affected
SUSE Manager Server 4.1 kernel-source Affected
SUSE Manager Server 4.2 kernel-source Affected
SUSE OpenStack Cloud 7 kernel-source Affected
SUSE OpenStack Cloud 8 kernel-source Affected
SUSE OpenStack Cloud 9 kernel-source Affected
SUSE OpenStack Cloud Crowbar 8 kernel-source Affected
SUSE OpenStack Cloud Crowbar 9 kernel-source Affected
SUSE Real Time Module 15 SP3 kernel-source-rt Affected
SUSE Real Time Module 15 SP4 kernel-source-rt Affected
openSUSE Leap 15.3 kernel-source Affected
openSUSE Leap 15.3 kernel-source-rt Affected
openSUSE Leap 15.4 kernel-source Affected
openSUSE Leap 15.4 kernel-source-azure Unsupported
openSUSE Leap 15.4 kernel-source-rt Affected


SUSE Timeline for this CVE

CVE page created: Thu Nov 7 12:01:28 2024
CVE page last modified: Sat Nov 16 20:02:05 2024