Race Condition Affecting kernel-debug-modules-core package, versions *


Severity

Recommended
medium

Based on CentOS security rating.

Threat Intelligence

EPSS
0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-CENTOS9-KERNELDEBUGMODULESCORE-6676724
  • published27 Apr 2024
  • disclosed24 Apr 2024

Introduced: 24 Apr 2024

CVE-2024-26923  (opens in a new tab)
CWE-362  (opens in a new tab)

How to fix?

There is no fixed version for Centos:9 kernel-debug-modules-core.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-debug-modules-core package and not the kernel-debug-modules-core package as distributed by Centos. See How to fix? for Centos:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix garbage collector racing against connect()

Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM_RIGHTS, two consecutive passes of scan_children() may see a different set of children. Leading to an incorrectly elevated inflight count, and then a dangling pointer within the gc_inflight_list.

sockets are AF_UNIX/SOCK_STREAM S is an unconnected socket L is a listening in-flight socket bound to addr, not in fdtable V's fd will be passed via sendmsg(), gets inflight count bumped

connect(S, addr) sendmsg(S, [V]); close(V) __unix_gc()


NS = unix_create1() skb1 = sock_wmalloc(NS) L = unix_find_other(addr) unix_state_lock(L) unix_peer(S) = NS // V count=1 inflight=0

         NS = unix_peer(S)
         skb2 = sock_alloc()
        skb_queue_tail(NS, skb2[V])

    // V became in-flight
    // V count=2 inflight=1

    close(V)

    // V count=1 inflight=1
    // GC candidate condition met

                for u in gc_inflight_list:
                  if (total_refs == inflight_refs)
                    add u to gc_candidates

                // gc_candidates={L, V}

                for u in gc_candidates:
                  scan_children(u, dec_inflight)

                // embryo (skb1) was not
                // reachable from L yet, so V's
                // inflight remains unchanged

__skb_queue_tail(L, skb1) unix_state_unlock(L) for u in gc_candidates: if (u.inflight) scan_children(u, inc_inflight_move_tail)

                    // V count=1 inflight=2 (!)

If there is a GC-candidate listening socket, lock/unlock its state. This makes GC wait until the end of any ongoing connect() to that socket. After flipping the lock, a possibly SCM-laden embryo is already enqueued. And if there is another embryo coming, it can not possibly carry SCM_RIGHTS. At this point, unix_inflight() can not happen because unix_gc_lock is already taken. Inflight graph remains unaffected.

CVSS Scores

version 3.1