bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx
Affects Linux kernel 5.15.0 to before 6.6.62 and 6.7.0 to before 6.11.9 when sockmap is used with vsock or af_unix sockets. Fixed in 6.6.62 and 6.11.9.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 6.6.62, 6.11.9
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx As the introduction of the support for vsock and unix sockets in sockmap, tls_sw_has_ctx_tx/rx cannot presume the socket passed in must be IS_ICSK. vsock and af_unix sockets have vsock_sock and unix_sock instead of inet_connection_sock. For these sockets, tls_get_ctx may return an invalid pointer and cause page fault in function tls_sw_ctx_rx. BUG: unable to handle page fault for address: 0000000000040030 Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:sk_psock_strp_data_ready+0x23/0x60 Call Trace: ? __die+0x81/0xc3 ? no_context+0x194/0x350 ? do_page_fault+0x30/0x110 ? async_page_fault+0x3e/0x50 ? sk_psock_strp_data_ready+0x23/0x60 virtio_transport_recv_pkt+0x750/0x800 ? update_load_avg+0x7e/0x620 vsock_loopback_work+0xd0/0x100 process_one_work+0x1a7/0x360 worker_thread+0x30/0x390 ? create_worker+0x1a0/0x1a0 kthread+0x112/0x130 ? __kthread_cancel_work+0x40/0x40 ret_from_fork+0x1f/0x40 v2: • Add IS_ICSK check v3: • Update the commits in Fixes
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
Version range not reported
- Linux Linux
5.15
- KernelLinux
From 5.15.0 · fixed in 6.6.62; From 6.7.0 · fixed in 6.11.9
References 4
Questions about CVE-2024-53091
What does this mean?
The kernel can crash with a page fault when tls_get_ctx returns an invalid pointer for vsock or af_unix sockets used with sockmap. The fix adds socket type and ICSK checks before the TLS context is used.Source: git.kernel.org
Am I affected, and how do I check?
Kernel versions from 5.15.0 up to 6.6.62 and from 6.7.0 up to 6.11.9 are listed as affected. The bug needs sockmap used with vsock or af_unix sockets, so check the running kernel version with uname -r.Source: git.kernel.org
What should I do about it?
Upgrade to kernel 6.6.62 or later in the 6.6 series, or to 6.11.9 or later in the 6.11 series.Source: git.kernel.org
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data