Executive brief
A vulnerability exists in the Linux kernel's implementation of the SCTP networking protocol. It occurs when multiple applications attempt to share the same network port simultaneously, potentially causing the system to crash (denial of service). This issue primarily affects system stability and availability rather than the confidentiality of user data.
Technical details
A null pointer dereference exists in the sctp_hash_endpoint() function within the Linux kernel's SCTP implementation. The root cause is a lack of proper synchronization between reuseport_alloc(), reuseport_add_sock(), and reuseport_detach_sock() when handling sockets in the same reuseport group. An attacker with local access can trigger a race condition by concurrently creating and closing listeners on the same port with the SO_REUSEPORT option, leading to a kernel panic (Oops). The fix involves applying a locking strategy to __sctp_hash_endpoint() and __sctp_unhash_endpoint() using the hash bucket lock, similar to existing implementations in TCP/UDP.
Affected products
- Linux Linux Kernel 6.10.0-syzkaller-12585-g301927d2d2eb
Timeline
- 2024-07-31: patched: Patch submitted by Kuniyuki Iwashima
- 2024-08-26: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/05e4a0fa248240efd99a539853e844f0f0a9e6a5
- https://git.kernel.org/stable/c/1407be30fc17eff918a98e0a990c0e988f11dc84
- https://git.kernel.org/stable/c/52319d9d2f522ed939af31af70f8c3a0f0f67e6c
- https://git.kernel.org/stable/c/54b303d8f9702b8ab618c5032fae886b16356928
- https://git.kernel.org/stable/c/9ab0faa7f9ffe31296dbb9bbe6f76c72c14eea18
- https://git.kernel.org/stable/c/c9b3fc4f157867e858734e31022ebee8a24f0de7
- https://git.kernel.org/stable/c/e809a84c802377ef61525a298a1ec1728759b913