CVE-2024-36971

En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net: fix __dst_negative_advice() race __dst_negative_advice() no aplica las reglas adecuadas de RCU cuando se debe borrar sk->dst_cache, lo que genera una posible UAF. Las reglas de RCU son que primero debemos borrar sk->sk_dst_cache y luego llamar a dst_release(old_dst). Tenga en cuenta que sk_dst_reset(sk) implementa este protocolo correctamente, mientras que __dst_negative_advice() utiliza el orden incorrecto. Dado que ip6_negative_advice() tiene una lógica especial contra RTF_CACHE, esto significa que cada uno de los tres ->negative_advice() métodos existentes debe realizar sk_dst_reset() ellos mismos. Tenga en cuenta que la verificación de NULL dst está centralizada en __dst_negative_advice(), no es necesario duplicarla en varias devoluciones de llamada. Muchas gracias a Clement Lecigne por dar seguimiento a este problema. Este antiguo error se hizo visible después de la confirmación culpada, utilizando sockets UDP.

A use-after-free flaw was found in the Linux kernel's network route management. This flaw allows an attacker to alter the behavior of certain network connections.

In the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce proper RCU rules when sk->dst_cache must be cleared, leading to possible UAF. RCU rules are that we must first clear sk->sk_dst_cache, then call dst_release(old_dst). Note that sk_dst_reset(sk) is implementing this protocol correctly, while __dst_negative_advice() uses the wrong order. Given that ip6_negative_advice() has special logic against RTF_CACHE, this means each of the three ->negative_advice() existing methods must perform the sk_dst_reset() themselves. Note the check against NULL dst is centralized in __dst_negative_advice(), there is no need to duplicate it in various callbacks. Many thanks to Clement Lecigne for tracking this issue. This old bug became visible after the blamed commit, using UDP sockets.

This update for the Linux Kernel 5.3.18-150300_59_164 fixes several issues. The following security issues were fixed. Fixed __dst_negative_advice race. Vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans. Ipv6: avoid use-after-free in ip6_fragment. Tcp: Use refcount_inc_not_zero in tcp_twsk_unique. Fixed memory leak for not ip packets. Sch_cake: do not call cake_destroy from cake_init. Smb: client: fix use-after-free bug in cifs_debug_data_proc_show. Fixed potential UAF in smb2_is_network_name_deleted. Fixed potential UAF in smb2_is_valid_lease_break. Fixed potential UAF in cifs_signal_cifsd_for_reconnect. Ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions. Hfsplus: fix uninit-value in copy_name. Fs/9p: only translate RWX permissions for plain 9P2000. Fixed false-positive lockdep splat for spin_lock in __unix_gc. Fixed false-positive lockdep splat for spin_lock in __unix_gc. Drm/client: Fully protect modes with dev->mode_config.mutex.

Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.