CVE-2024-56642

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: Fix use-after-free of kernel socket in cleanup_bearer().

syzkaller reported a use-after-free of UDP kernel socket

in cleanup_bearer() without repro. [0][1]

When bearer_disable() calls tipc_udp_disable(), cleanup

of the UDP kernel socket is deferred by work calling

cleanup_bearer().

tipc_exit_net() waits for such works to finish by checking

tipc_net(net)->wq_count. However, the work decrements the

count too early before releasing the kernel socket,

unblocking cleanup_net() and resulting in use-after-free.

Let's move the decrement after releasing the socket in

cleanup_bearer().

[0]:

ref_tracker: net notrefcnt@000000009b3d1faf has 1/1 users at

sk_alloc+0x438/0x608

inet_create+0x4c8/0xcb0

__sock_create+0x350/0x6b8

sock_create_kern+0x58/0x78

udp_sock_create4+0x68/0x398

udp_sock_create+0x88/0xc8

tipc_udp_enable+0x5e8/0x848

__tipc_nl_bearer_enable+0x84c/0xed8

tipc_nl_b

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References