Executive brief
A race condition vulnerability was identified in the Linux kernel's AF_UNIX networking component, which handles local inter-process communication. An attacker with local access could potentially exploit this flaw to cause a system crash or unpredictable behavior during network socket operations. This issue primarily impacts system stability and availability.
Technical details
A data race exists in the af_unix implementation of the Linux kernel due to improper synchronization of the sk->sk_shutdown variable. While unix_release_sock() performs an atomic write using WRITE_ONCE, the reader function unix_stream_sendmsg() lacks a corresponding atomic read (READ_ONCE). This concurrency issue, detected by KCSAN, occurs when one task closes a socket while another is sending a message. An attacker with local user privileges can trigger this race to cause a kernel splat or denial of service. The vulnerability has been patched in various stable branches by ensuring atomic access to the shutdown state.
Affected products
- Linux Linux Kernel versions from 2.6.13 up to 4.19.316, 4.20 up to 5.4.278, 5.5 up to 5.10.219, 5.11 up to 5.15.161, 5.16 up to 6.1.93, 6.2 up to 6.6.33, 6.7 up to 6.8.12, 6.9 up to 6.9.3
Timeline
- 2024-05-09: patched: Initial patch submitted by Breno Leitao
- 2024-06-19: advisory: CVE published by NVD
References
- https://git.kernel.org/stable/c/0688d4e499bee3f2749bca27329bd128686230cb
- https://git.kernel.org/stable/c/4d51845d734a4c5d079e56e0916f936a55e15055
- https://git.kernel.org/stable/c/540bf24fba16b88c1b3b9353927204b4f1074e25
- https://git.kernel.org/stable/c/8299e4d778f664b31b67cf4cf3d5409de2ecb92c
- https://git.kernel.org/stable/c/9aa8773abfa0e954136875b4cbf2df4cf638e8a5
- https://git.kernel.org/stable/c/a4c88072abcaca593cefe70f90e9d3707526e8f9
- https://git.kernel.org/stable/c/a52fa2addfcccc2c5a0217fd45562605088c018b