CVE-2024-36972

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.8 through 6.9 Linux kernel version 5.15.147 Linux kernel version 6.1.78 Linux kernel version 6.6.17

Description A vulnerability in the Linux kernel's AF UNIX socket implementation allows for a race condition between the unix gc() and queue oob() functions. This can lead to a NULL pointer dereference, potentially causing a denial of service. The issue arises when the unix gc() function tries to garbage-collect closed inflight sockets and the peer socket sends an MSG OOB message, allowing queue oob() to update unix sk(sk)->oob skb concurrently. To fix the issue, the unix sk(sk)->oob skb needs to be updated under the sk receive queue lock.

Recommendations Linux kernel version 6.8 and later should update unix sk(sk)->oob skb under the sk receive queue lock to prevent the NULL pointer dereference. Linux kernel version 5.15.147 should update unix sk(sk)->oob skb under the sk receive queue lock to prevent the NULL pointer dereference. Linux kernel version 6.1.78 should update unix sk(sk)->oob skb under the sk receive queue lock to prevent the NULL pointer dereference. Linux kernel version 6.6.17 should update unix sk(sk)->oob skb under the sk receive queue lock to prevent the NULL pointer dereference.