From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AAF01135A68 for ; Tue, 27 Feb 2024 09:49:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709027364; cv=none; b=rgGaC3t0lGBz6rWrgcOb16oVmPxo3O/LiLaVhQKpLdvJp42oUHIrgLMZ+EQF7BqX4vAw4UpRZ0yCakQSjr71b+cGtkGODLsEP7aUtBTvNZoOZy/PdjlV6X6PV8nV0OjxjzknqOPyYqwxAqtx+7qDMZ4Sp8t4oBEi0soEu8bV/lw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709027364; c=relaxed/simple; bh=kbvPEC3kLtV4gFSWlP9c4ZmcVFbZ4BhSivIgHhoxVSI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=NrnmNyGSm2KiG1jmjWXLOO1ADfchWH4wdc9KYjYoNW1lBvPiMsCyx4AD5kN7vg40OhB0LHcDOVHZgV0KNMXykvnN22UE5SEJVVRc5/7oNdUpM+CEv5R4i5xF//FqpDsBuD2PFoRil2buajr5Hnzi+aA/fX68XvpZqxwPBgihqFg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qRUaYrF0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="qRUaYrF0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53714C433C7; Tue, 27 Feb 2024 09:49:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1709027363; bh=kbvPEC3kLtV4gFSWlP9c4ZmcVFbZ4BhSivIgHhoxVSI=; h=From:To:Cc:Subject:Date:Reply-to:From; b=qRUaYrF0/Vnk7JCqfgdTqugYfbLjpf85iJi3iA+NkGMVyC2K3VlKVtnj45T35madL jkWBPtrGcYRinPhSmfG4BYoCpvfeLoEtyk67AGVJp/tTo8FaE100EPmgF1sMXh/ghj DyiByk5wTDwTAyO3tazCIXp2jyOE54LVFb6G0yoI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2021-46936: net: fix use-after-free in tw_timer_handler Date: Tue, 27 Feb 2024 10:48:57 +0100 Message-ID: <2024022751-CVE-2021-46936-2f8a@gregkh> X-Mailer: git-send-email 2.44.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=4288; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=kbvPEC3kLtV4gFSWlP9c4ZmcVFbZ4BhSivIgHhoxVSI=; b=owGbwMvMwCRo6H6F97bub03G02pJDKl3NzAzLUibyrpKXtZ6Ugz3ka/mgtMswqZPeyKUev5Pe W4UK/eejlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZiItyzDPGP7jot5PC919+su eWocXz+ZTaJ3BcOC7XdubbfTYWTT/3x3o+jP27G8F//tBAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: net: fix use-after-free in tw_timer_handler A real world panic issue was found as follow in Linux 5.4. BUG: unable to handle page fault for address: ffffde49a863de28 PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0 RIP: 0010:tw_timer_handler+0x20/0x40 Call Trace: call_timer_fn+0x2b/0x120 run_timer_softirq+0x1ef/0x450 __do_softirq+0x10d/0x2b8 irq_exit+0xc7/0xd0 smp_apic_timer_interrupt+0x68/0x120 apic_timer_interrupt+0xf/0x20 This issue was also reported since 2017 in the thread [1], unfortunately, the issue was still can be reproduced after fixing DCCP. The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net namespace is destroyed since tcp_sk_ops is registered befrore ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops in the list of pernet_list. There will be a use-after-free on net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net if there are some inflight time-wait timers. This bug is not introduced by commit f2bf415cfed7 ("mib: add net to NET_ADD_STATS_BH") since the net_statistics is a global variable instead of dynamic allocation and freeing. Actually, commit 61a7e26028b9 ("mib: put net statistics on struct net") introduces the bug since it put net statistics on struct net and free it when net namespace is destroyed. Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug and replace pr_crit() with panic() since continuing is meaningless when init_ipv4_mibs() fails. [1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1 The Linux kernel CVE team has assigned CVE-2021-46936 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 4.4.298 with commit 15579e1301f8 Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 4.9.296 with commit e73164e89d1b Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 4.14.261 with commit 5c2fe20ad37f Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 4.19.224 with commit a8e1944b44f9 Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 5.4.170 with commit fe5838c22b98 Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 5.10.90 with commit 2386e81a1d27 Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 5.15.13 with commit 08eacbd141e2 Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 5.16 with commit e22e45fc9e41 Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2021-46936 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv4/af_inet.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022 https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41a https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4 https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566 https://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69 https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4 https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13 https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0