Lockless Setsockopt Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-26732: In the Linux kernel, the following vulnerability has been resolved: net: implement lockless setsockopt(SO_PEEK_OFF) syzbot reported a lockdep violation [1] involving af_unix support of SO_PEEK_OFF. Affects linux versions < 6.7.7-1. Fixed in 6.7.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of functionalities, including process management, memory management, and network communication. This vulnerability specifically affects the socket options related to the Unix domain sockets, where improper locking mechanisms can lead to potential deadlocks and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the handling of the SO_PEEK_OFF socket option within the af_unix support. This issue arises from the inherent lack of thread safety in SO_PEEK_OFF, which utilizes a per-socket sk_peek_off field. The vulnerability was reported by syzbot, highlighting a lockdep violation that could lead to a deadlock scenario. The existing locking mechanism was deemed unnecessary, and the patch implemented removes the socket lock acquisition during setsockopt(SO_PEEK_OFF), thereby preventing potential circular locking dependencies and improving overall thread safety.
How To Fix
Minimum fixed version
6.7.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid using the SO_PEEK_OFF socket option until the system is updated to the patched version. This will help mitigate the risk of encountering deadlock scenarios related to this vulnerability.
Conclusion
The vulnerability in the Linux kernel regarding the SO_PEEK_OFF socket option poses a significant risk of deadlocks and system instability. It is crucial for users to update their systems to the patched version 6.7.7-1 to mitigate these risks. Until then, avoiding the use of this socket option is recommended.
See every vulnerability recorded for linux →
FAQ
SO_PEEK_OFF is a socket option that allows applications to specify an offset for peeking at incoming data on a socket without removing it from the queue.
This vulnerability can lead to deadlocks in applications that utilize the SO_PEEK_OFF option, potentially causing system instability and crashes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
If an immediate update is not possible, refrain from using the SO_PEEK_OFF socket option as a temporary measure to avoid potential deadlocks.
Detailed information about this vulnerability can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-26732.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
