Junglewise Threat Intelligence

CVE-2024-35910: Linux Kernel race condition in TCP kernel socket timers

CVE-2024-35910 · Severity: medium · CVSS 5.8 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local attacker to cause a system crash or instability. The issue occurs when certain internal network timers continue to run after the network environment they belong to has been shut down. This primarily affects kernel-level services and could lead to a denial-of-service condition, impacting the availability of the affected system.

Technical details

A use-after-free or race condition exists in the Linux kernel TCP implementation because kernel sockets do not hold a reference count on their associated network namespace (netns). When TCP sockets are closed, the kernel traditionally uses non-synchronous timer deletion (del_timer), which allows ongoing timers to finish after the socket is closed. For kernel sockets, this creates a window where a timer can fire after the netns has been freed. The fix introduces inet_csk_clear_xmit_timers_sync(), which utilizes sk_stop_timer_sync() to ensure all timers are fully terminated before the kernel socket is released. This vulnerability is reachable locally and requires specific timing conditions to exploit.

Affected products

  • Linux Linux kernel 4.2 to 4.19.312, 4.20 to 5.4.274, 5.5 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.85, 6.2 to 6.6.26, 6.7 to 6.8.5, 6.9-rc1

Timeline

  • 2024-03-22: patched: Initial patch authored by Eric Dumazet
  • 2024-05-19: disclosed: CVE published

References

Related threats