Bug 2230094 - kernel: Race Condition leading to UAF in Unix Socket could happen in sk_receive_queue
Summary: kernel: Race Condition leading to UAF in Unix Socket could happen in sk_recei...
Keywords:
Status: CLOSED DUPLICATE of bug 2237760
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2230095 2230096 2230097 2230098 2233137 2233138 2233139 2233140 2233141 2233143 2233144 2233145 2233146 2233147 2233150 2233151 2233152 2233153 2233154 2233155 2233156 2233157 2233163 2233164 2233165 2233166 2233167 2233168 2233169 2233170 2233171
Blocks: 2230092
TreeView+ depends on / blocked
 
Reported: 2023-08-08 17:27 UTC by Alex
Modified: 2024-03-13 09:08 UTC (History)
52 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2023-10-12 15:07:07 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:0679 0 None None None 2024-02-05 11:45:50 UTC
Red Hat Product Errata RHSA-2024:0402 0 None None None 2024-01-24 15:04:55 UTC
Red Hat Product Errata RHSA-2024:0403 0 None None None 2024-01-24 15:05:29 UTC
Red Hat Product Errata RHSA-2024:0412 0 None None None 2024-01-24 16:44:34 UTC
Red Hat Product Errata RHSA-2024:0439 0 None None None 2024-01-24 16:36:15 UTC
Red Hat Product Errata RHSA-2024:0575 0 None None None 2024-01-30 13:22:05 UTC
Red Hat Product Errata RHSA-2024:1250 0 None None None 2024-03-12 00:44:01 UTC
Red Hat Product Errata RHSA-2024:1306 0 None None None 2024-03-13 09:08:27 UTC

Description Alex 2023-08-08 17:27:24 UTC 
A flaw in the Linux Kernel found. Race Condition leading to UAF in the Unix Socket could happen in function sk_receive_queue. There is a race condition when garbage collection unlink skb from sk_receive_queue and at same time other thread is try to modify a skb. It can lead to use after free, when skb is freed at __skb_queue_purge but it is also able to be modified in unix_stream_sendpage.

Reference:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=790c2f9d15b594350ae9bca7b236f2b1859de02c
Comment 9 Alex 2023-10-12 15:07:07 UTC 

*** This bug has been marked as a duplicate of bug 2237760 ***
Comment 18 errata-xmlrpc 2024-01-24 15:04:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2024:0402 https://access.redhat.com/errata/RHSA-2024:0402
Comment 19 errata-xmlrpc 2024-01-24 15:05:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2024:0403 https://access.redhat.com/errata/RHSA-2024:0403
Comment 20 errata-xmlrpc 2024-01-24 16:36:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0439 https://access.redhat.com/errata/RHSA-2024:0439
Comment 21 errata-xmlrpc 2024-01-24 16:44:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0412 https://access.redhat.com/errata/RHSA-2024:0412
Comment 24 errata-xmlrpc 2024-01-30 13:22:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0575 https://access.redhat.com/errata/RHSA-2024:0575
Comment 25 errata-xmlrpc 2024-03-12 00:43:58 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:1250 https://access.redhat.com/errata/RHSA-2024:1250
Comment 26 errata-xmlrpc 2024-03-13 09:08:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:1306 https://access.redhat.com/errata/RHSA-2024:1306
Note You need to log in before you can comment on or make changes to this bug.