CVE-2024-56664

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description A race condition exists between element replacement and close() in the Linux kernel's bpf and sockmap handling. This can lead to a situation where an element is unreferenced incorrectly, resulting in a slab-use-after-free error. The issue arises when an element replacement occurs concurrently with the close() operation on a socket, causing the sock map delete() function to unconditionally unref the wrong element. This can trigger a KASAN splat and produce refcount t warnings.

Recommendations To resolve this issue, update the Linux kernel to version 6.6.74 or later. As a temporary workaround, consider disabling the sock map update elem function until a patch is available. Restrict access to the vulnerable sock map free function to minimize the risk of exploitation. Avoid using the map update elem function with sockets that are being closed concurrently.