In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix garbage collector racing against connect()
Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCMRIGHTS, two consecutive passes of scanchildren() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gcinflightlist.
sockets are AFUNIX/SOCKSTREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped
connect(S, addr) sendmsg(S, [V]); close(V) _unixgc() ---------------- ------------------------- -----------
NS = unixcreate1() skb1 = sockwmalloc(NS) L = unixfindother(addr) unixstatelock(L) unix_peer(S) = NS // V count=1 inflight=0
NS = unix_peer(S)
skb2 = sock_alloc()
skb_queue_tail(NS, skb2[V])
// V became in-flight
// V count=2 inflight=1
close(V)
// V count=1 inflight=1
// GC candidate condition met
for u in gc_inflight_list:
if (total_refs == inflight_refs)
add u to gc_candidates
// gc_candidates={L, V}
for u in gc_candidates:
scan_children(u, dec_inflight)
// embryo (skb1) was not
// reachable from L yet, so V's
// inflight remains unchanged
_skbqueuetail(L, skb1) unixstateunlock(L) for u in gccandidates: if (u.inflight) scanchildren(u, incinflightmovetail)
// V count=1 inflight=2 (!)
If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCMRIGHTS. At this point, unixinflight() can not happen because unixgclock is already taken. Inflight graph remains unaffected.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247313632362000557681439634814653617003",
"225240012471257624316609982004119038788",
"237475675945084381784996008223390676253",
"45357760908702270405087243136282333814",
"198347599488074683909057318167912198406",
"107858477545749964358376846251504242693",
"244993795812341974696846497482787712037",
"115611268172369308342931816655427995262",
"304613538574637326588055915306575351528",
"130247343054700722034937596086818004261"
]
},
"target": {
"file": "net/unix/garbage.c"
},
"signature_version": "v1",
"id": "CVE-2024-26923-153ea339",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e76c2678228f6aec74b305ae30c9374cc2f28a51"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"122920127131213858102134753415047248769",
"319908282437410479085541387421506056779",
"278940835524629575759825104918924838702",
"100682501803387475719901164668727951322",
"283013095320175714379169964006468018027",
"206688331583033760130838952328910362633",
"244993795812341974696846497482787712037",
"115611268172369308342931816655427995262",
"304613538574637326588055915306575351528",
"130247343054700722034937596086818004261"
]
},
"target": {
"file": "net/unix/garbage.c"
},
"signature_version": "v1",
"id": "CVE-2024-26923-18c58423",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47d8ac011fe1c9251070e1bd64cb10b48193ec51"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247313632362000557681439634814653617003",
"225240012471257624316609982004119038788",
"237475675945084381784996008223390676253",
"45357760908702270405087243136282333814",
"198347599488074683909057318167912198406",
"107858477545749964358376846251504242693",
"244993795812341974696846497482787712037",
"115611268172369308342931816655427995262",
"304613538574637326588055915306575351528",
"130247343054700722034937596086818004261"
]
},
"target": {
"file": "net/unix/garbage.c"
},
"signature_version": "v1",
"id": "CVE-2024-26923-575680ce",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e2a03787f4f0abc0072350654ab0ef3324d9db3"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "208102392801727682837033639742828568898",
"length": 1938.0
},
"target": {
"file": "net/unix/garbage.c",
"function": "unix_gc"
},
"signature_version": "v1",
"id": "CVE-2024-26923-631d6aa8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2e2a03787f4f0abc0072350654ab0ef3324d9db3"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247313632362000557681439634814653617003",
"225240012471257624316609982004119038788",
"237475675945084381784996008223390676253",
"45357760908702270405087243136282333814",
"198347599488074683909057318167912198406",
"107858477545749964358376846251504242693",
"244993795812341974696846497482787712037",
"115611268172369308342931816655427995262",
"304613538574637326588055915306575351528",
"130247343054700722034937596086818004261"
]
},
"target": {
"file": "net/unix/garbage.c"
},
"signature_version": "v1",
"id": "CVE-2024-26923-66f71c0b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a36ae0ec2353015f0f6762e59f4c2dbc0c906423"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "316026394728532231166056187935696610553",
"length": 2089.0
},
"target": {
"file": "net/unix/garbage.c",
"function": "unix_gc"
},
"signature_version": "v1",
"id": "CVE-2024-26923-69bf3785",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507cc232ffe53a352847893f8177d276c3b532a9"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "27682202121951841194007484691936494877",
"length": 1676.0
},
"target": {
"file": "net/unix/garbage.c",
"function": "__unix_gc"
},
"signature_version": "v1",
"id": "CVE-2024-26923-9460d657",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@47d8ac011fe1c9251070e1bd64cb10b48193ec51"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247313632362000557681439634814653617003",
"225240012471257624316609982004119038788",
"237475675945084381784996008223390676253",
"45357760908702270405087243136282333814",
"198347599488074683909057318167912198406",
"107858477545749964358376846251504242693",
"244993795812341974696846497482787712037",
"115611268172369308342931816655427995262",
"304613538574637326588055915306575351528",
"130247343054700722034937596086818004261"
]
},
"target": {
"file": "net/unix/garbage.c"
},
"signature_version": "v1",
"id": "CVE-2024-26923-94fbfaa5",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b75722be422c276b699200de90527d01c602ea7c"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "215147063308967458301514025733541609798",
"length": 1645.0
},
"target": {
"file": "net/unix/garbage.c",
"function": "unix_gc"
},
"signature_version": "v1",
"id": "CVE-2024-26923-96bfb47b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a36ae0ec2353015f0f6762e59f4c2dbc0c906423"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "316026394728532231166056187935696610553",
"length": 2089.0
},
"target": {
"file": "net/unix/garbage.c",
"function": "unix_gc"
},
"signature_version": "v1",
"id": "CVE-2024-26923-96f1e226",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dbdf7bec5c920200077d693193f989cb1513f009"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247313632362000557681439634814653617003",
"225240012471257624316609982004119038788",
"237475675945084381784996008223390676253",
"45357760908702270405087243136282333814",
"198347599488074683909057318167912198406",
"107858477545749964358376846251504242693",
"244993795812341974696846497482787712037",
"115611268172369308342931816655427995262",
"304613538574637326588055915306575351528",
"130247343054700722034937596086818004261"
]
},
"target": {
"file": "net/unix/garbage.c"
},
"signature_version": "v1",
"id": "CVE-2024-26923-9ab470cb",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dbdf7bec5c920200077d693193f989cb1513f009"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247313632362000557681439634814653617003",
"225240012471257624316609982004119038788",
"237475675945084381784996008223390676253",
"45357760908702270405087243136282333814",
"198347599488074683909057318167912198406",
"107858477545749964358376846251504242693",
"244993795812341974696846497482787712037",
"115611268172369308342931816655427995262",
"304613538574637326588055915306575351528",
"130247343054700722034937596086818004261"
]
},
"target": {
"file": "net/unix/garbage.c"
},
"signature_version": "v1",
"id": "CVE-2024-26923-9ffcdf48",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343c5372d5e17b306db5f8f3c895539b06e3177f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "208102392801727682837033639742828568898",
"length": 1938.0
},
"target": {
"file": "net/unix/garbage.c",
"function": "unix_gc"
},
"signature_version": "v1",
"id": "CVE-2024-26923-a05fd709",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343c5372d5e17b306db5f8f3c895539b06e3177f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "202148699059998200178298428058688701248",
"length": 2066.0
},
"target": {
"file": "net/unix/garbage.c",
"function": "unix_gc"
},
"signature_version": "v1",
"id": "CVE-2024-26923-b2400398",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b75722be422c276b699200de90527d01c602ea7c"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247313632362000557681439634814653617003",
"225240012471257624316609982004119038788",
"237475675945084381784996008223390676253",
"45357760908702270405087243136282333814",
"198347599488074683909057318167912198406",
"107858477545749964358376846251504242693",
"244993795812341974696846497482787712037",
"115611268172369308342931816655427995262",
"304613538574637326588055915306575351528",
"130247343054700722034937596086818004261"
]
},
"target": {
"file": "net/unix/garbage.c"
},
"signature_version": "v1",
"id": "CVE-2024-26923-c287d364",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@507cc232ffe53a352847893f8177d276c3b532a9"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "202148699059998200178298428058688701248",
"length": 2066.0
},
"target": {
"file": "net/unix/garbage.c",
"function": "unix_gc"
},
"signature_version": "v1",
"id": "CVE-2024-26923-c9274289",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e76c2678228f6aec74b305ae30c9374cc2f28a51"
}
]