CVE-2024-36971

In the Linux kernel, the following vulnerability has been resolved:

net: fix __dst_negative_advice() race

__dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF.

RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst).

Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order.

Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves.

Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks.

Many thanks to Clement Lecigne for tracking this issue.

This old bug became visible after the blamed commit, using UDP sockets.

Weakness

Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

Affected Software

Extended Description

The use of previously-freed memory can have any number of adverse consequences, ranging from the corruption of valid data to the execution of arbitrary code, depending on the instantiation and timing of the flaw. The simplest way data corruption may occur involves the system’s reuse of the freed memory. Use-after-free errors have two common and sometimes overlapping causes:

In this scenario, the memory in question is allocated to another pointer validly at some point after it has been freed. The original pointer to the freed memory is used again and points to somewhere within the new allocation. As the data is changed, it corrupts the validly used memory; this induces undefined behavior in the process. If the newly allocated data happens to hold a class, in C++ for example, various function pointers may be scattered within the heap data. If one of these function pointers is overwritten with an address to valid shellcode, execution of arbitrary code can be achieved.

Potential Mitigations

References

• https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13
• https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6
• https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508
• https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4
• https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e
• https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc
• https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72
• https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf
• https://git.kernel.org/stable/c/051c0bde9f0450a2ec3d62a86d2a0d2fad117f13
• https://git.kernel.org/stable/c/2295a7ef5c8c49241bff769e7826ef2582e532a6
• https://git.kernel.org/stable/c/5af198c387128a9d2ddd620b0f0803564a4d4508
• https://git.kernel.org/stable/c/81dd3c82a456b0015461754be7cb2693991421b4
• https://git.kernel.org/stable/c/92f1655aa2b2294d0b49925f3b875a634bd3b59e
• https://git.kernel.org/stable/c/b8af8e6118a6605f0e495a58d591ca94a85a50fc
• https://git.kernel.org/stable/c/db0082825037794c5dba9959c9de13ca34cc5e72
• https://git.kernel.org/stable/c/eacb8b195579c174a6d3e12a9690b206eb7f28cf