CVE-2024-36905

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets

TCP_SYN_RECV state is really special, it is only used by

cross-syn connections, mostly used by fuzzers.

In the following crash [1], syzbot managed to trigger a divide

by zero in tcp_rcv_space_adjust()

A socket makes the following state transitions,

without ever calling tcp_init_transfer(),

meaning tcp_init_buffer_space() is also not called.

TCP_CLOSE

connect()

TCP_SYN_SENT

TCP_SYN_RECV

shutdown() -> tcp_shutdown(sk, SEND_SHUTDOWN)

TCP_FIN_WAIT1

To fix this issue, change tcp_shutdown() to not

perform a TCP_SYN_RECV -> TCP_FIN_WAIT1 transition,

which makes no sense anyway.

When tcp_rcv_state_process() later changes socket state

from TCP_SYN_RECV to TCP_ESTABLISH, then look at

sk->sk_shutdown to finally enter TCP_FIN_WAIT1 state,

and send a FIN packet from a sane socket state.

This means tcp_send_fin() can now be called

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References