UDP Socket Address Change Race Condition in Linux Kernel
Summary
DEBIAN-CVE-2024-57974: In the Linux kernel, the following vulnerability has been resolved: udp: Deal with race between UDP socket address change and rehash If a UDP socket changes its local address while it's receiving datagrams, as a result o... Affects linux versions < 6.12.13-1. Fixed in 6.12.13-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of a Linux operating system, responsible for managing hardware, system resources, and providing essential services for software applications. It supports a wide range of functionalities, including process management, memory management, and networking. The kernel's networking stack, particularly the UDP (User Datagram Protocol) implementation, is crucial for handling datagram-based communication. This vulnerability affects the Linux kernel versions in Debian 13 and 14, specifically in the handling of UDP socket address changes during datagram reception.
Vulnerability Detail
In the Linux kernel, a race condition exists between the UDP socket address change and the rehash operation. When a UDP socket changes its local address while receiving datagrams, there is a window of time where a lookup operation may fail to find the socket. This occurs after the address change but before the secondary hash and four-tuple hash are updated. As a result, clients may experience a 'Connection refused' error when attempting to send datagrams to the server. This issue can lead to communication failures in applications relying on UDP, particularly noticeable in scenarios involving multiple CPU threads.
How To Fix
Minimum fixed version
6.12.13-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid the race condition by ensuring that UDP sockets do not change their local address while receiving datagrams. This may involve modifying application logic to prevent simultaneous address changes and datagram reception.
Conclusion
The vulnerability in the Linux kernel related to UDP socket address changes poses a significant risk to applications relying on UDP communication. By updating to the patched version, users can mitigate this risk and ensure stable network operations.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the UDP socket handling of the Linux kernel, which can lead to failed datagram lookups and connection errors.
The vulnerability affects the Linux kernel versions in Debian 13 and 14 prior to the fixed version 6.12.13-1.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
The vulnerability can lead to communication failures in applications that rely on UDP, resulting in connection errors and disrupted services.
Yes, the permanent fix is to update the Linux package to version 6.12.13-1 or later, which resolves the race condition.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
