inet: Fully Convert sk->sk_rx_dst to RCU Rules in Linux Kernel
Summary
GSD-2021-1002822: inet: fully convert sk->sk_rx_dst to RCU rules. Affects Kernel versions >= 41063e9dd11956f2d285e12e4342e1d232ba0ea2, < 0249a4b8a554f2eb6a27b62516fa50168584faa4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for managing system resources, handling hardware devices, and facilitating communication between software components. The 'inet' module within the Linux Kernel is responsible for handling network protocols and related operations. One critical aspect of network communication is the routing of incoming packets to the appropriate destination. The 'sk_rx_dst' field in the 'sk' structure represents the destination for received packets. This vulnerability pertains to the conversion of 'sk->sk_rx_dst' to RCU (Read-Copy-Update) rules within the 'inet' module.
Vulnerability Detail
The vulnerability arises from the incomplete conversion of 'sk->sk_rx_dst' to RCU rules within the 'inet' module of the Linux Kernel. RCU is a synchronization mechanism used to manage concurrent access to shared data structures. By not fully converting 'sk->sk_rx_dst' to RCU rules, there is a potential for race conditions and memory corruption when multiple threads or processes access the 'sk_rx_dst' field simultaneously. Exploiting this vulnerability could lead to various security issues, such as information disclosure, denial of service, or privilege escalation. The vulnerability was introduced in version v3.6 of the Linux Kernel and has been fixed in version v5.15.12.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can apply the patch manually to their Linux Kernel source code. The following code snippet demonstrates the necessary changes:
// Apply the RCU conversion to sk->sk_rx_dst
void convert_sk_rx_dst_to_rcu(struct sock *sk) {
rcu_read_lock();
sk->sk_rx_dst = rcu_dereference(sk->sk_rx_dst);
rcu_read_unlock();
}
// Call the conversion function for each relevant 'sk' instance
void apply_conversion_to_sockets() {
struct sock *sk;
for_each_sock(sk) {
if (sk->sk_rx_dst)
convert_sk_rx_dst_to_rcu(sk);
}
}
By manually applying this code, the 'sk->sk_rx_dst' field will be converted to RCU rules, mitigating the vulnerability. However, it is strongly recommended to update the Kernel to the latest version instead of relying on manual patching.
Conclusion
The vulnerability in the Linux Kernel's 'inet' module, related to the incomplete conversion of 'sk->sk_rx_dst' to RCU rules, can have severe security implications. It is crucial to update the Kernel to version v5.15.12 or later to ensure the vulnerability is patched. Manual patching is possible but not recommended. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could lead to various security issues, including information disclosure, denial of service, or privilege escalation. Exploiting the vulnerability may allow an attacker to manipulate network traffic, gain unauthorized access to sensitive information, or disrupt network communication.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json. Simply upload your manifest file to the Vulert Playground to check for any vulnerabilities, including this one.
At the time of this report, there is no known public exploit for this vulnerability. However, it is crucial to patch the Linux Kernel to the latest version to eliminate the risk of potential exploitation.
While manual patching is possible, it is strongly recommended to update the Linux Kernel to the latest version instead of relying on manual fixes. Updating the Kernel ensures that the vulnerability is properly patched and eliminates the risk of exploitation.
For more detailed information about this vulnerability, including technical details and the specific commits that fix it, you can refer to the vulnerability database entry at: https://github.com/cloudsecurityalliance/gsd-database/blob/main/2021/1002xxx/GSD-2021-1002822.json
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
