In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix disconnect vs accept race
Despite commit 0ad529d9fd2b ("mptcp: fix possible divide by zero in recvmsg()"), the mptcp protocol is still prone to a race between disconnect() (or shutdown) and accept.
The root cause is that the mentioned commit checks the msk-level flag, but mptcpstreamaccept() does acquire the msk-level lock, as it can rely directly on the first subflow lock.
As reported by Christoph than can lead to a race where an msk socket is accepted after that mptcpsubflowqueue_clean() releases the listener socket lock and just before it takes destructive actions leading to the following splat:
BUG: kernel NULL pointer dereference, address: 0000000000000012 PGD 5a4ca067 P4D 5a4ca067 PUD 37d4c067 PMD 0 Oops: 0000 [#1] PREEMPT SMP CPU: 2 PID: 10955 Comm: syz-executor.5 Not tainted 6.5.0-rc1-gdc7b257ee5dd #37 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 RIP: 0010:mptcpstreamaccept+0x1ee/0x2f0 include/net/inetsock.h:330 Code: 0a 09 00 48 8b 1b 4c 39 e3 74 07 e8 bc 7c 7f fe eb a1 e8 b5 7c 7f fe 4c 8b 6c 24 08 eb 05 e8 a9 7c 7f fe 49 8b 85 d8 09 00 00 <0f> b6 40 12 88 44 24 07 0f b6 6c 24 07 bf 07 00 00 00 89 ee e8 89 RSP: 0018:ffffc90000d07dc0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff888037e8d020 RCX: ffff88803b093300 RDX: 0000000000000000 RSI: ffffffff833822c5 RDI: ffffffff8333896a RBP: 0000607f82031520 R08: ffff88803b093300 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000003e83 R12: ffff888037e8d020 R13: ffff888037e8c680 R14: ffff888009af7900 R15: ffff888009af6880 FS: 00007fc26d708640(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000012 CR3: 0000000066bc5001 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> doaccept+0x1ae/0x260 net/socket.c:1872 _sysaccept4+0x9b/0x110 net/socket.c:1913 _dosysaccept4 net/socket.c:1954 [inline] _sesysaccept4 net/socket.c:1951 [inline] _x64sysaccept4+0x20/0x30 net/socket.c:1951 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x47/0xa0 arch/x86/entry/common.c:80 entrySYSCALL64after_hwframe+0x6e/0xd8
Address the issue by temporary removing the pending request socket from the accept queue, so that racing accept() can't touch them.
After depleting the msk - the ssk still exists, as plain TCP sockets, re-insert them into the accept queue, so that later inetcsklisten_stop() will complete the tcp socket disposal.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169147432970783781173282064657360406181",
"7556261218604498800927634109107486528",
"72388586650550834011805277571565591713",
"150298093311214531444496496059403915678"
]
},
"target": {
"file": "net/mptcp/protocol.h"
},
"signature_version": "v1",
"id": "CVE-2023-53490-0eb3ff0d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2b4c84eb7149f34c0f25f17042d095ba5357d68"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "199927252626467086310384204854609059933",
"length": 1038.0
},
"target": {
"file": "net/mptcp/subflow.c",
"function": "mptcp_subflow_queue_clean"
},
"signature_version": "v1",
"id": "CVE-2023-53490-28a6fb98",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@511b90e39250135a7f900f1c3afbce25543018a2"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "199927252626467086310384204854609059933",
"length": 1038.0
},
"target": {
"file": "net/mptcp/subflow.c",
"function": "mptcp_subflow_queue_clean"
},
"signature_version": "v1",
"id": "CVE-2023-53490-43a3f815",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2b4c84eb7149f34c0f25f17042d095ba5357d68"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "199927252626467086310384204854609059933",
"length": 1038.0
},
"target": {
"file": "net/mptcp/subflow.c",
"function": "mptcp_subflow_queue_clean"
},
"signature_version": "v1",
"id": "CVE-2023-53490-5e1f3092",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded9f5551ce5cafa3c41c794428c27a0d0a00542"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323964784091145190884435266197223111755",
"125625985365302327086130792165961400096",
"253561290342349114241276793211061042023",
"317032330186670918063257338409636889946",
"99997026668773046892184267263533195243",
"296131322014008891417131407119070748771",
"9729728626261963958594201299354573265",
"16483173832109370531983157861940102717",
"79113357941324625443119163504682683308",
"183703785127476953879083111060595740579",
"49348955872532197962154304139704349561",
"92647931557926163216472118210938300041",
"128668671461452903291126259831163752751",
"64002734858914583738107645866807307619",
"37981327026771610038784523025184472525",
"255724704173672194074837984354168054903",
"58005626373982411964913483348815845668",
"18091286017320898090606292981192903219",
"263151602381341084235370507209553625679",
"170734292287270889741694288759403821467",
"244288472965177909282855257283040036871",
"22387024284843515481942919193119666216",
"261362455598573109799857492293574600622",
"299901396311982675123844833199374943946",
"226276493371193766834724511170574532457",
"294700945090958542184903589593892635287",
"134966123344504373816708571846603095339",
"177558644347370556099594126264412825691",
"136116507605311894239887983960214871972",
"275490914398857071315018368035573427403",
"283607670707203139570013162935289280987",
"203346392472122624972443236279878931651",
"285222193688558129911362768310632674541",
"238467748278205104826088565984800057484"
]
},
"target": {
"file": "net/mptcp/subflow.c"
},
"signature_version": "v1",
"id": "CVE-2023-53490-7b7ac9ae",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2b4c84eb7149f34c0f25f17042d095ba5357d68"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323964784091145190884435266197223111755",
"125625985365302327086130792165961400096",
"253561290342349114241276793211061042023",
"317032330186670918063257338409636889946",
"99997026668773046892184267263533195243",
"296131322014008891417131407119070748771",
"9729728626261963958594201299354573265",
"16483173832109370531983157861940102717",
"79113357941324625443119163504682683308",
"183703785127476953879083111060595740579",
"49348955872532197962154304139704349561",
"92647931557926163216472118210938300041",
"128668671461452903291126259831163752751",
"64002734858914583738107645866807307619",
"37981327026771610038784523025184472525",
"255724704173672194074837984354168054903",
"58005626373982411964913483348815845668",
"18091286017320898090606292981192903219",
"263151602381341084235370507209553625679",
"170734292287270889741694288759403821467",
"244288472965177909282855257283040036871",
"22387024284843515481942919193119666216",
"261362455598573109799857492293574600622",
"299901396311982675123844833199374943946",
"226276493371193766834724511170574532457",
"294700945090958542184903589593892635287",
"134966123344504373816708571846603095339",
"177558644347370556099594126264412825691",
"136116507605311894239887983960214871972",
"275490914398857071315018368035573427403",
"283607670707203139570013162935289280987",
"203346392472122624972443236279878931651",
"285222193688558129911362768310632674541",
"238467748278205104826088565984800057484"
]
},
"target": {
"file": "net/mptcp/subflow.c"
},
"signature_version": "v1",
"id": "CVE-2023-53490-82158eef",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@511b90e39250135a7f900f1c3afbce25543018a2"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323964784091145190884435266197223111755",
"125625985365302327086130792165961400096",
"253561290342349114241276793211061042023",
"317032330186670918063257338409636889946",
"99997026668773046892184267263533195243",
"296131322014008891417131407119070748771",
"9729728626261963958594201299354573265",
"16483173832109370531983157861940102717",
"79113357941324625443119163504682683308",
"183703785127476953879083111060595740579",
"49348955872532197962154304139704349561",
"92647931557926163216472118210938300041",
"128668671461452903291126259831163752751",
"64002734858914583738107645866807307619",
"37981327026771610038784523025184472525",
"255724704173672194074837984354168054903",
"58005626373982411964913483348815845668",
"18091286017320898090606292981192903219",
"263151602381341084235370507209553625679",
"170734292287270889741694288759403821467",
"244288472965177909282855257283040036871",
"22387024284843515481942919193119666216",
"261362455598573109799857492293574600622",
"299901396311982675123844833199374943946",
"226276493371193766834724511170574532457",
"294700945090958542184903589593892635287",
"134966123344504373816708571846603095339",
"177558644347370556099594126264412825691",
"136116507605311894239887983960214871972",
"275490914398857071315018368035573427403",
"283607670707203139570013162935289280987",
"203346392472122624972443236279878931651",
"285222193688558129911362768310632674541",
"238467748278205104826088565984800057484"
]
},
"target": {
"file": "net/mptcp/subflow.c"
},
"signature_version": "v1",
"id": "CVE-2023-53490-8b83b866",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded9f5551ce5cafa3c41c794428c27a0d0a00542"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"37760748767584371051524075349528518181",
"7556261218604498800927634109107486528",
"72388586650550834011805277571565591713",
"150298093311214531444496496059403915678"
]
},
"target": {
"file": "net/mptcp/protocol.h"
},
"signature_version": "v1",
"id": "CVE-2023-53490-a27a29e0",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@511b90e39250135a7f900f1c3afbce25543018a2"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169147432970783781173282064657360406181",
"7556261218604498800927634109107486528",
"72388586650550834011805277571565591713",
"150298093311214531444496496059403915678"
]
},
"target": {
"file": "net/mptcp/protocol.h"
},
"signature_version": "v1",
"id": "CVE-2023-53490-b4997fa8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ded9f5551ce5cafa3c41c794428c27a0d0a00542"
}
]