Skip to content
Heist/ feed
Unrated

sctp: Fix null-ptr-deref in reuseport_add_sock().

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: sctp: Fix null-ptr-deref in reuseport_add_sock(). syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in reuseport_add_sock(). [0] The repro first creates a listener with SO_REUSEPORT. Then, it creates another listener on the same port and concurrently closes the first listener. The second listen() calls reuseport_add_sock() with the first listener as sk2, where sk2->sk_reuseport_cb is not expected to be cleared concurrently, but the close() does clear it by reuseport_detach_sock(). The problem is SCTP does not properly synchronise reuseport_alloc(), reuseport_add_sock(), and reuseport_detach_sock(). The caller of reuseport_alloc() and reuseport_{add,detach}_sock() must provide synchronisation for sockets that are classified into the same reuseport group. Otherwise, such sockets form multiple identical reuseport groups, and all groups except one would be silently dead. 1. Two sockets call listen() concurrently 2. No socket in the same group found in sctp_ep_hashtable[] 3. Two sockets call reuseport_alloc() and form two reuseport groups 4. Only one group hit first in __sctp_rcv_lookup_endpoint() receives incoming packets Also, the reported null-ptr-deref could occur. TCP/UDP guarantees that would not happen by holding the hash bucket lock. Let's apply the locking strategy to __sctp_hash_endpoint() and __sctp_unhash_endpoint(). [0]: Oops: general protection fault, probably for non-canonical ad

Announced Source revision 1
Original source ↗

CVE-2024-44935

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-44935

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "6ba84574026792ce33a40c7da721dea36d0f3973",
        "lessThan": "c9b3fc4f157867e858734e31022ebee8a24f0de7",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6ba84574026792ce33a40c7da721dea36d0f3973",
        "lessThan": "52319d9d2f522ed939af31af70f8c3a0f0f67e6c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6ba84574026792ce33a40c7da721dea36d0f3973",
        "lessThan": "54b303d8f9702b8ab618c5032fae886b16356928",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6ba84574026792ce33a40c7da721dea36d0f3973",
        "lessThan": "05e4a0fa248240efd99a539853e844f0f0a9e6a5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6ba84574026792ce33a40c7da721dea36d0f3973",
        "lessThan": "1407be30fc17eff918a98e0a990c0e988f11dc84",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6ba84574026792ce33a40c7da721dea36d0f3973",
        "lessThan": "e809a84c802377ef61525a298a1ec1728759b913",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "6ba84574026792ce33a40c7da721dea36d0f3973",
        "lessThan": "9ab0faa7f9ffe31296dbb9bbe6f76c72c14eea18",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/sctp/input.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.0"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.4.282",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.224",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.165",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.105",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.46",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.10.5",
        "versionType": "semver",
        "lessThanOrEqual": "6.10.*"
      },
      {
        "status": "unaffected",
        "version": "6.11",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/sctp/input.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-44935

Source reference: /cveMetadata/cveId

Publisher severity

No explicit severity was provided.

Event
#26698 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement