Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when specific network connection states are handled incorrectly, leading to a system failure (divide-by-zero error). This primarily impacts system availability and could be used to disrupt operations or services running on the affected machine.
Technical details
A divide-by-zero error exists in tcp_rcv_space_adjust() within the Linux kernel's TCP stack. The vulnerability is triggered when a socket in the TCP_SYN_RECV state (often associated with cross-SYN connections) undergoes a shutdown(SEND_SHUTDOWN) transition to TCP_FIN_WAIT1 without having initialized buffer space via tcp_init_transfer(). This bypasses necessary initialization, leading to a division by zero during receive space adjustment. The fix involves deferring the shutdown transition until the socket reaches the TCP_ESTABLISH state. This issue was identified by syzbot and affects multiple stable kernel versions.
Affected products
- Linux Linux Kernel Fixed in 6.9.0-rc6 and various stable branches
Timeline
- 2024-05-01: patched: Initial patch authored by Eric Dumazet
- 2024-05-30: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/2552c9d9440f8e7a2ed0660911ff00f25b90a0a4
- https://git.kernel.org/stable/c/34e41a031fd7523bf1cd00a2adca2370aebea270
- https://git.kernel.org/stable/c/3fe4ef0568a48369b1891395d13ac593b1ba41b1
- https://git.kernel.org/stable/c/413c33b9f3bc36fdf719690a78824db9f88a9485
- https://git.kernel.org/stable/c/94062790aedb505bdda209b10bea47b294d6394f
- https://git.kernel.org/stable/c/cbf232ba11bc86a5281b4f00e1151349ef4d45cf
- https://git.kernel.org/stable/c/ed5e279b69e007ce6c0fe82a5a534c1b19783214