CVE-2023-52986

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener

A listening socket linked to a sockmap has its sk_prot overridden. It points to one of the struct proto variants in tcp_bpf_prots. The variant depends on the sockets family and which sockmap programs are attached.

A child socket cloned from a TCP listener initially inherits their sk_prot. But before cloning is finished, we restore the childs proto to the listeners original non-tcp_bpf_prots one. This happens in tcp_create_openreq_child -> tcp_bpf_clone.

Today, in tcp_bpf_clone we detect if the childs proto should be restored by checking only for the TCP_BPF_BASE proto variant. This is not correct. The sk_prot of listening socket linked to a sockmap can point to to any variant in tcp_bpf_prots.

If the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then the child socket unintentionally is left if the inherited sk_prot by tcp_bpf_clone.

This leads to issues like infinite recursion on close 1, because the child state is otherwise not set up for use with tcp_bpf_prot operations.

Adjust the check in tcp_bpf_clone to detect all of tcp_bpf_prots variants.

Note that it wouldnt be sufficient to check the socket state when overriding the sk_prot in tcp_bpf_update_proto in order to always use the TCP_BPF_BASE variant for listening sockets. Since commit b8b8315e39ff (bpf, sockmap: Remove unhash handler for BPF sockmap usage) it is possible for a socket to transition to TCP_LISTEN state while already linked to a sockmap, e.g. connect() -> insert into map -> connect(AF_UNSPEC) -> listen().

Weakness

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/230.html
• https://cwe.mitre.org/data/definitions/231.html

References

• https://git.kernel.org/stable/c/12b0ec7c6953e1602957926439e5297095d7d065
• https://git.kernel.org/stable/c/9bd6074e1872d22190a8da30e796cbf937d334f0
• https://git.kernel.org/stable/c/c681d7a4ed3d360de0574f4d6b7305a8de8dc54f
• https://git.kernel.org/stable/c/ddce1e091757d0259107c6c0c7262df201de2b66