Resource Leak Affecting kernel-debug package, versions <0:4.18.0-477.70.1.el8_8


Severity

Recommended
high

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-KERNELDEBUG-7894012
  • published4 Sept 2024
  • disclosed21 Jun 2024

Introduced: 21 Jun 2024

CVE-2024-36489  (opens in a new tab)
CWE-402  (opens in a new tab)
First added by Snyk

How to fix?

Upgrade RHEL:8 kernel-debug to version 0:4.18.0-477.70.1.el8_8 or higher.
This issue was patched in RHSA-2024:6206.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-debug package and not the kernel-debug package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

tls: fix missing memory barrier in tls_init

In tls_init(), a write memory barrier is missing, and store-store reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.

CPU0 CPU1


// In tls_init() // In tls_ctx_create() ctx = kzalloc() ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)

// In update_sk_prot() WRITE_ONCE(sk->sk_prot, tls_prots) -(2)

                               // In sock_common_setsockopt()
                               READ_ONCE(sk-&gt;sk_prot)-&gt;setsockopt()

                           // In tls_{setsockopt,getsockopt}()
                           ctx-&amp;gt;sk_proto-&amp;gt;setsockopt()    -(3)

In the above scenario, when (1) and (2) are reordered, (3) can observe the NULL value of ctx->sk_proto, causing NULL dereference.

To fix it, we rely on rcu_assign_pointer() which implies the release barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is initialized, we can ensure that ctx->sk_proto are visible when changing sk->sk_prot.

CVSS Scores

version 3.1