CVE-2024-26750

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Drop oob_skb ref before purging queue in GC.

syzbot reported another task hung in __unix_gc(). [0]

The current while loop assumes that all of the left candidates

have oob_skb and calling kfree_skb(oob_skb) releases the remaining

candidates.

However, I missed a case that oob_skb has self-referencing fd and

another fd and the latter sk is placed before the former in the

candidate list. Then, the while loop never proceeds, resulting

the task hung.

__unix_gc() has the same loop just before purging the collected skb,

so we can call kfree_skb(oob_skb) there and let __skb_queue_purge()

release all inflight sockets.

[0]:

Sending NMI from CPU 0 to CPUs 1:

NMI backtrace for cpu 1

CPU: 1 PID: 2784 Comm: kworker/u4:8 Not tainted 6.8.0-rc4-syzkaller-01028-g71b605d32017 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024

Workqueue: events_unbound __unix_gc

RIP: 0010:__sanitiz

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References