CVE-2024-36904
Description
In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's sk_refcnt after putting it into ehash and releasing the bucket lock. Thus, there is a small race window where other threads could try to reuse the port during connect() and call sock_hold() in tcp_twsk_unique() for the TIME-WAIT socket with zero refcnt. If that happens, the refcnt taken by tcp_twsk_unique() is overwritten and sock_put() will cause underflow, triggering a real use-after-free somewhere else. To avoid the use-after-free, we need to use refcount_inc_not_zero() in tcp_twsk_unique() and give up on reusing the port if it returns false. [0]: refcount_t: addition on 0; use-after-free. WARNING: CPU: 0 PID: 1039313 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110 CPU: 0 PID: 1039313 Comm: trigger Not tainted 6.8.6-200.fc39.x86_64 #1 Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.21805430.B64.2305221830 05/22/2023 RIP: 0010:refcount_warn_saturate+0xe5/0x110 Code: 42 8e ff 0f 0b c3 cc cc cc cc 80 3d aa 13 ea 01 00 0f 85 5e ff ff ff 48 c7 c7 f8 8e b7 82 c6 05 96 13 ea 01 01 e8 7b 42 8e ff <0f> 0b c3 cc cc cc cc 48 c7 c7 50 8f b7 82 c6 05 7a 13 ea 01 01 e8 RSP: 0018:ffffc90006b43b60 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff888009bb3ef0 RCX: 0000000000000027 RDX: ffff88807be218c8 RSI: 0000000000000001 RDI: ffff88807be218c0 RBP: 0000000000069d70 R08: 0000000000000000 R09: ffffc90006b439f0 R10: ffffc90006b439e8 R11: 0000000000000003 R12: ffff8880029ede84 R13: 0000000000004e20 R14: ffffffff84356dc0 R15: ffff888009bb3ef0 FS: 00007f62c10926c0(0000) GS:ffff88807be00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020ccb000 CR3: 000000004628c005 CR4: 0000000000f70ef0 PKRU: 55555554 Call Trace: <TASK> ? refcount_warn_saturate+0xe5/0x110 ? __warn+0x81/0x130 ? refcount_warn_saturate+0xe5/0x110 ? report_bug+0x171/0x1a0 ? refcount_warn_saturate+0xe5/0x110 ? handle_bug+0x3c/0x80 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? refcount_warn_saturate+0xe5/0x110 tcp_twsk_unique+0x186/0x190 __inet_check_established+0x176/0x2d0 __inet_hash_connect+0x74/0x7d0 ? __pfx___inet_check_established+0x10/0x10 tcp_v4_connect+0x278/0x530 __inet_stream_connect+0x10f/0x3d0 inet_stream_connect+0x3a/0x60 __sys_connect+0xa8/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0x83/0x170 entry_SYSCALL_64_after_hwframe+0x78/0x80 RIP: 0033:0x7f62c11a885d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a3 45 0c 00 f7 d8 64 89 01 48 RSP: 002b:00007f62c1091e58 EFLAGS: 00000296 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000020ccb004 RCX: 00007f62c11a885d RDX: 0000000000000010 RSI: 0000000020ccb000 RDI: 0000000000000003 RBP: 00007f62c1091e90 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 00007f62c10926c0 R13: ffffffffffffff88 R14: 0000000000000000 R15: 00007ffe237885b0 </TASK>
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: alma — https://errata.almalinux.org/9/ALSA-2024-4583.html
Vendor advisory: alma — https://bugzilla.redhat.com/2294225
Vendor advisory: alma — https://bugzilla.redhat.com/2293456
Vendor advisory: alma — https://bugzilla.redhat.com/2293402
Vendor advisory: alma — https://bugzilla.redhat.com/2293380
Vendor advisory: alma — https://bugzilla.redhat.com/2293230
Vendor advisory: alma — https://bugzilla.redhat.com/2284581
Vendor advisory: alma — https://bugzilla.redhat.com/2281925
Vendor advisory: alma — https://bugzilla.redhat.com/2281131
Vendor advisory: alma — https://bugzilla.redhat.com/2280434
Vendor advisory: alma — https://bugzilla.redhat.com/2275735
Vendor advisory: alma — https://bugzilla.redhat.com/2273466
Vendor advisory: alma — https://bugzilla.redhat.com/2273082
Vendor advisory: alma — https://bugzilla.redhat.com/2267509
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2024-5102.html
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2024:5102
Vendor advisory: alma — https://errata.almalinux.org/8/ALSA-2024-5101.html
Vendor advisory: alma — https://bugzilla.redhat.com/2298108
Vendor advisory: alma — https://bugzilla.redhat.com/2297558
Vendor advisory: alma — https://bugzilla.redhat.com/2297511
Vendor advisory: alma — https://bugzilla.redhat.com/2297474
Vendor advisory: alma — https://bugzilla.redhat.com/2297056
Vendor advisory: alma — https://bugzilla.redhat.com/2296067
Vendor advisory: alma — https://bugzilla.redhat.com/2295914
Vendor advisory: alma — https://bugzilla.redhat.com/2294274
Vendor advisory: alma — https://bugzilla.redhat.com/2293711
Vendor advisory: alma — https://bugzilla.redhat.com/2293700
Vendor advisory: alma — https://bugzilla.redhat.com/2293687
Vendor advisory: alma — https://bugzilla.redhat.com/2293684
Vendor advisory: alma — https://bugzilla.redhat.com/2293657
Vendor advisory: alma — https://bugzilla.redhat.com/2293653
Vendor advisory: alma — https://bugzilla.redhat.com/2293461
Vendor advisory: alma — https://bugzilla.redhat.com/2293444
Vendor advisory: alma — https://bugzilla.redhat.com/2293420
Vendor advisory: alma — https://bugzilla.redhat.com/2293418
Vendor advisory: alma — https://bugzilla.redhat.com/2293383
Vendor advisory: alma — https://bugzilla.redhat.com/2293371
Vendor advisory: alma — https://bugzilla.redhat.com/2293367
Vendor advisory: alma — https://bugzilla.redhat.com/2293348
Vendor advisory: alma — https://bugzilla.redhat.com/2293316
Vendor advisory: alma — https://bugzilla.redhat.com/2293312
Vendor advisory: alma — https://bugzilla.redhat.com/2293276
Vendor advisory: alma — https://bugzilla.redhat.com/2293250
Vendor advisory: alma — https://bugzilla.redhat.com/2293078
Vendor advisory: alma — https://bugzilla.redhat.com/2292331
Vendor advisory: alma — https://bugzilla.redhat.com/2290408
Vendor advisory: alma — https://bugzilla.redhat.com/2284625
Vendor advisory: alma — https://bugzilla.redhat.com/2284590
Vendor advisory: alma — https://bugzilla.redhat.com/2284571
Vendor advisory: alma — https://bugzilla.redhat.com/2284556
Vendor advisory: alma — https://bugzilla.redhat.com/2284541
Vendor advisory: alma — https://bugzilla.redhat.com/2284539
Vendor advisory: alma — https://bugzilla.redhat.com/2284519
Vendor advisory: alma — https://bugzilla.redhat.com/2284513
Vendor advisory: alma — https://bugzilla.redhat.com/2284500
Vendor advisory: alma — https://bugzilla.redhat.com/2284496
Vendor advisory: alma — https://bugzilla.redhat.com/2284488
Vendor advisory: alma — https://bugzilla.redhat.com/2284477
Vendor advisory: alma — https://bugzilla.redhat.com/2284474
Vendor advisory: alma — https://bugzilla.redhat.com/2284465
Vendor advisory: alma — https://bugzilla.redhat.com/2284421
Vendor advisory: alma — https://bugzilla.redhat.com/2284417
Vendor advisory: alma — https://bugzilla.redhat.com/2284400
Vendor advisory: alma — https://bugzilla.redhat.com/2283894
Vendor advisory: alma — https://bugzilla.redhat.com/2283401
Vendor advisory: alma — https://bugzilla.redhat.com/2282950
Vendor advisory: alma — https://bugzilla.redhat.com/2282925
Vendor advisory: alma — https://bugzilla.redhat.com/2282923
Vendor advisory: alma — https://bugzilla.redhat.com/2282896
Vendor advisory: alma — https://bugzilla.redhat.com/2282887
Vendor advisory: alma — https://bugzilla.redhat.com/2282780
Vendor advisory: alma — https://bugzilla.redhat.com/2282772
Vendor advisory: alma — https://bugzilla.redhat.com/2282766
Vendor advisory: alma — https://bugzilla.redhat.com/2282763
Vendor advisory: alma — https://bugzilla.redhat.com/2282759
Vendor advisory: alma — https://bugzilla.redhat.com/2282744
Vendor advisory: alma — https://bugzilla.redhat.com/2282743
Vendor advisory: alma — https://bugzilla.redhat.com/2282742
Vendor advisory: alma — https://bugzilla.redhat.com/2282727
Vendor advisory: alma — https://bugzilla.redhat.com/2282719
Vendor advisory: alma — https://bugzilla.redhat.com/2282717
Vendor advisory: alma — https://bugzilla.redhat.com/2282690
Vendor advisory: alma — https://bugzilla.redhat.com/2282645
Vendor advisory: alma — https://bugzilla.redhat.com/2282642
Vendor advisory: alma — https://bugzilla.redhat.com/2282640
Vendor advisory: alma — https://bugzilla.redhat.com/2282623
Vendor advisory: alma — https://bugzilla.redhat.com/2282615
Vendor advisory: alma — https://bugzilla.redhat.com/2282553
Vendor advisory: alma — https://bugzilla.redhat.com/2282479
Vendor advisory: alma — https://bugzilla.redhat.com/2282373
Vendor advisory: alma — https://bugzilla.redhat.com/2282328
Vendor advisory: alma — https://bugzilla.redhat.com/2281989
Vendor advisory: alma — https://bugzilla.redhat.com/2281968
Vendor advisory: alma — https://bugzilla.redhat.com/2281949
Vendor advisory: alma — https://bugzilla.redhat.com/2281938
Vendor advisory: alma — https://bugzilla.redhat.com/2281833
Vendor advisory: alma — https://bugzilla.redhat.com/2281821
Vendor advisory: alma — https://bugzilla.redhat.com/2281819
Vendor advisory: alma — https://bugzilla.redhat.com/2281758
Vendor advisory: alma — https://bugzilla.redhat.com/2281752
Vendor advisory: alma — https://bugzilla.redhat.com/2281725
Vendor advisory: alma — https://bugzilla.redhat.com/2281682
Vendor advisory: alma — https://bugzilla.redhat.com/2281675
Vendor advisory: alma — https://bugzilla.redhat.com/2281672
Vendor advisory: alma — https://bugzilla.redhat.com/2281667
Vendor advisory: alma — https://bugzilla.redhat.com/2281664
Vendor advisory: alma — https://bugzilla.redhat.com/2281641
Vendor advisory: alma — https://bugzilla.redhat.com/2281636
Vendor advisory: alma — https://bugzilla.redhat.com/2281519
Vendor advisory: alma — https://bugzilla.redhat.com/2281510
Vendor advisory: alma — https://bugzilla.redhat.com/2281360
Vendor advisory: alma — https://bugzilla.redhat.com/2281326
Vendor advisory: alma — https://bugzilla.redhat.com/2281268
Vendor advisory: alma — https://bugzilla.redhat.com/2281235
Vendor advisory: alma — https://bugzilla.redhat.com/2281221
Vendor advisory: alma — https://bugzilla.redhat.com/2281215
Vendor advisory: alma — https://bugzilla.redhat.com/2281207
Vendor advisory: alma — https://bugzilla.redhat.com/2281190
Vendor advisory: alma — https://bugzilla.redhat.com/2281189
Vendor advisory: alma — https://bugzilla.redhat.com/2281149
Vendor advisory: alma — https://bugzilla.redhat.com/2281133
Vendor advisory: alma — https://bugzilla.redhat.com/2281054
Vendor advisory: alma — https://bugzilla.redhat.com/2280440
Vendor advisory: alma — https://bugzilla.redhat.com/2278989
Vendor advisory: alma — https://bugzilla.redhat.com/2278539
Vendor advisory: alma — https://bugzilla.redhat.com/2278535
Vendor advisory: alma — https://bugzilla.redhat.com/2278515
Vendor advisory: alma — https://bugzilla.redhat.com/2278484
Vendor advisory: alma — https://bugzilla.redhat.com/2278380
Vendor advisory: alma — https://bugzilla.redhat.com/2278279
Vendor advisory: alma — https://bugzilla.redhat.com/2278277
Vendor advisory: alma — https://bugzilla.redhat.com/2278258
Vendor advisory: alma — https://bugzilla.redhat.com/2278256
Vendor advisory: alma — https://bugzilla.redhat.com/2278218
Vendor advisory: alma — https://bugzilla.redhat.com/2278182
Vendor advisory: alma — https://bugzilla.redhat.com/2278178
Vendor advisory: alma — https://bugzilla.redhat.com/2278176
Vendor advisory: alma — https://bugzilla.redhat.com/2277840
Vendor advisory: alma — https://bugzilla.redhat.com/2277238
Vendor advisory: alma — https://bugzilla.redhat.com/2277166
Vendor advisory: alma — https://bugzilla.redhat.com/2275928
Vendor advisory: alma — https://bugzilla.redhat.com/2275761
Vendor advisory: alma — https://bugzilla.redhat.com/2275748
Vendor advisory: alma — https://bugzilla.redhat.com/2275744
Vendor advisory: alma — https://bugzilla.redhat.com/2275711
Vendor advisory: alma — https://bugzilla.redhat.com/2275694
Vendor advisory: alma — https://bugzilla.redhat.com/2275580
Vendor advisory: alma — https://bugzilla.redhat.com/2275573
Vendor advisory: alma — https://bugzilla.redhat.com/2275565
Vendor advisory: alma — https://bugzilla.redhat.com/2273654
Vendor advisory: alma — https://bugzilla.redhat.com/2273427
Vendor advisory: alma — https://bugzilla.redhat.com/2273268
Vendor advisory: alma — https://bugzilla.redhat.com/2273247
Vendor advisory: alma — https://bugzilla.redhat.com/2273242
Vendor advisory: alma — https://bugzilla.redhat.com/2273236
Vendor advisory: alma — https://bugzilla.redhat.com/2273174
Vendor advisory: alma — https://bugzilla.redhat.com/2273117
Vendor advisory: alma — https://bugzilla.redhat.com/2273109
Vendor advisory: alma — https://bugzilla.redhat.com/2272795
Vendor advisory: alma — https://bugzilla.redhat.com/2272782
Vendor advisory: alma — https://bugzilla.redhat.com/2271688
Vendor advisory: alma — https://bugzilla.redhat.com/2271686
Vendor advisory: alma — https://bugzilla.redhat.com/2270700
Vendor advisory: alma — https://bugzilla.redhat.com/2270100
Vendor advisory: alma — https://bugzilla.redhat.com/2270084
Vendor advisory: alma — https://bugzilla.redhat.com/2269211
Vendor advisory: alma — https://bugzilla.redhat.com/2269070
Vendor advisory: alma — https://bugzilla.redhat.com/2268118
Vendor advisory: alma — https://bugzilla.redhat.com/2267787
Vendor advisory: alma — https://bugzilla.redhat.com/2266594
Vendor advisory: alma — https://bugzilla.redhat.com/2266497
Vendor advisory: alma — https://bugzilla.redhat.com/2266347
Vendor advisory: alma — https://bugzilla.redhat.com/2266341
Vendor advisory: alma — https://bugzilla.redhat.com/2265797
Vendor advisory: alma — https://bugzilla.redhat.com/2265650
Vendor advisory: alma — https://bugzilla.redhat.com/2265645
Vendor advisory: alma — https://bugzilla.redhat.com/2263879
Vendor advisory: alma — https://access.redhat.com/errata/RHSA-2024:5101
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2024-36904
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:4583
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2024-36904.html
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:5101
Vendor advisory: rocky — https://errata.rockylinux.org/RLSA-2024:5102
Vendor advisory: rocky — https://errata.rockylinux.org/RXSA-2024:5101
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/f2db7230f73a80dbb179deab78f88a7947f0ab7e
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/84546cc1aeeb4df3e444b18a4293c9823f974be9
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/6e48faad92be13166184d21506e4e54c79c13adc
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/517e32ea0a8c72202d0d8aa8df50a7cd3d6fdefc
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/27b0284d8be182a81feb65581ab6a724dfd596e8
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/1d9cf07810c30ef7948879567d10fd1f01121d34
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/1796ca9c6f5bd50554214053af5f47d112818ee3
Vendor advisory: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 — https://git.kernel.org/stable/c/13ed7cdf079686ccd3618335205700c03f6fb446
Vendor advisory: redhat — https://access.redhat.com/errata/RHSA-2024:4583
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| rhel | 9 | fixed | |
| rocky | 8 | fixed | |
| sles | affected | | |
| rocky | 9 | fixed | |
| debian | bookworm | fixed | 6.1.94-1 |
| debian | bullseye | fixed | 5.10.218-1 |
| debian | forky | fixed | 6.8.11-1 |
| debian | sid | fixed | 6.8.11-1 |
| debian | trixie | fixed | 6.8.11-1 |
| debian | 10.0 | affected | |
| linux-kernel | affected | 4.19.314 | |
| linux-kernel | 6.9 | affected | |
| almalinux | 8 | fixed | kernel-doc-4.18.0-553.16.1.el8_10.noarch.rpm |
References
- https://access.redhat.com/errata/RHSA-2024:4583
- https://git.kernel.org/stable/c/13ed7cdf079686ccd3618335205700c03f6fb446
- https://git.kernel.org/stable/c/1796ca9c6f5bd50554214053af5f47d112818ee3
- https://git.kernel.org/stable/c/1d9cf07810c30ef7948879567d10fd1f01121d34
- https://git.kernel.org/stable/c/27b0284d8be182a81feb65581ab6a724dfd596e8
- https://git.kernel.org/stable/c/517e32ea0a8c72202d0d8aa8df50a7cd3d6fdefc
- https://git.kernel.org/stable/c/6e48faad92be13166184d21506e4e54c79c13adc
- https://git.kernel.org/stable/c/84546cc1aeeb4df3e444b18a4293c9823f974be9
- https://git.kernel.org/stable/c/f2db7230f73a80dbb179deab78f88a7947f0ab7e
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
- https://security.netapp.com/advisory/ntap-20240905-0004/
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html
- https://errata.rockylinux.org/RXSA-2024:5101
- https://errata.rockylinux.org/RLSA-2024:5102
- https://errata.rockylinux.org/RLSA-2024:5101
- https://www.suse.com/security/cve/CVE-2024-36904.html
- https://errata.rockylinux.org/RLSA-2024:4583
- https://security-tracker.debian.org/tracker/CVE-2024-36904
- https://access.redhat.com/errata/RHSA-2024:5101
- https://bugzilla.redhat.com/2263879
- https://bugzilla.redhat.com/2265645
- https://bugzilla.redhat.com/2265650
CWEs
CWE-416
Verify integrity in audit chain (admin only). AS-IS.