CVE-2024-56633

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg

The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging

tosend bytes, which is either msg->sg.size or a smaller value apply_bytes.

Potential problems with this strategy are as follows:

- If the actual sent bytes are smaller than tosend, we need to charge some

bytes back, as in line 487, which is okay but seems not clean.

- When tosend is set to apply_bytes, as in line 417, and (ret < 0), we may

miss uncharging (msg->sg.size - apply_bytes) bytes.

[...]

415 tosend = msg->sg.size;

416 if (psock->apply_bytes && psock->apply_bytes < tosend)

417 tosend = psock->apply_bytes;

[...]

443 sk_msg_return(sk, msg, tosend);

444 release_sock(sk);

446 origsize = msg->sg.size;

447 ret = tcp_bpf_sendmsg_redir(sk_redir, redir_ingress,

448 msg, tosend, flags);

449 sent = origsize - msg->sg.size;

[...]

454 lock_sock(sk);

455 i

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References