Executive brief
A race condition vulnerability was identified in the Linux kernel's networking subsystem. This flaw occurs when multiple processing threads simultaneously access memory allocation data for network sockets, specifically during IPv6 and DCCP connection handling. An attacker could potentially exploit this to cause a system crash or denial-of-service condition, impacting the availability of the affected server or device.
Technical details
A data race exists in the Linux kernel networking stack around 'sk->sk_forward_alloc'. The vulnerability occurs when 'tcp_v6_do_rcv()' or 'dccp_v6_do_rcv()' is called concurrently by multiple threads while the socket is in the 'TCP_LISTEN' state without the socket lock being held. This leads to unsynchronized updates to the forward memory allocation counter via 'sk_forward_alloc_add()'. Specifically, 'skb_clone_and_charge_r()' was being incorrectly invoked for listening sockets, leading to mismatched memory reclamation and potential kernel warnings or crashes. The fix ensures these functions are not called when the socket is in a listening state.
Affected products
- Linux Linux Kernel 6.12.0-rc5
Timeline
- 2024-11-07: patched: Initial patch submitted by Wang Liang
- 2024-12-02: advisory: CVE-2024-53124 published
References
- https://git.kernel.org/stable/c/073d89808c065ac4c672c0a613a71b27a80691cb
- https://git.kernel.org/stable/c/3f51f8c9d28954cf380100883a02eed35a8277e9
- https://git.kernel.org/stable/c/695fb0b9aecfd5dd5b2946ba8897ac2c1eef654d
- https://git.kernel.org/stable/c/be7c61ea5f816168c38955eb4e898adc8b4b32fd
- https://git.kernel.org/stable/c/c3d052cae566ec2285f5999958a5deb415a0f59e
- https://git.kernel.org/stable/c/d285eb9d0641c8344f2836081b4ccb7b3c5cc1b6
- https://git.kernel.org/stable/c/fe2c0bd6d1e29ccefdc978b9a290571c93c27473