af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.111, 6.18.53, 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. Fahad Alharbi reported that recv(0, MSG_PEEK) triggers busy-wait in unix_stream_read_generic() if recv() is blocking and the last skb in the queue is MSG_OOB skb. In such a situation, TCP returns 0 immediately regardless of blocking or non-blocking. Let's follow the behaviour.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 314001f0bf927015e459c9d387d62a231fe93af3 · fixed in 3d3c7a3df66b2ca3d2cd1a2a0c37eb701feba713; From 314001f0bf927015e459c9d387d62a231fe93af3 · fixed in d5dd55b316ca229a4cbf11729483ba5bb57233e7; From 314001f0bf927015e459c9d387d62a231fe93af3 · fixed in c81c5be3826c8467945b964d0cf7f7b3d65461db; From 314001f0bf927015e459c9d387d62a231fe93af3 · fixed in 6e5ee08eb5858d175da6768d75d163817b6a9d4a
- Linux Linux
5.15
- KernelLinux
From 5.15.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.2.7