CVE-2024-35910

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: properly terminate timers for kernel sockets

We had various syzbot reports about tcp timers firing after

the corresponding netns has been dismantled.

Fortunately Josef Bacik could trigger the issue more often,

and could test a patch I wrote two years ago.

When TCP sockets are closed, we call inet_csk_clear_xmit_timers()

to 'stop' the timers.

inet_csk_clear_xmit_timers() can be called from any context,

including when socket lock is held.

This is the reason it uses sk_stop_timer(), aka del_timer().

This means that ongoing timers might finish much later.

For user sockets, this is fine because each running timer

holds a reference on the socket, and the user socket holds

a reference on the netns.

For kernel sockets, we risk that the netns is freed before

timer can complete, because kernel sockets do not hold

reference on the netns.

This patch adds inet_csk_clear_xmit_timers_sync() function

that using sk_stop_ti

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References