161 lines
11 KiB
JSON
161 lines
11 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-64459",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-07-19T15:36:31.789Z",
|
|
"datePublished": "2026-07-25T08:51:26.879Z",
|
|
"dateUpdated": "2026-08-17T04:56:03.943Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-17T04:56:03.943Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: restore RCU grace period in tcp_ao_destroy_sock\n\nCommit 51e547e8c89c (\"tcp: Free TCP-AO/TCP-MD5 info/keys without RCU\")\nremoved the call_rcu() callback from tcp_ao_destroy_sock(), arguing that\n\"the destruction of info/keys is delayed until the socket destructor\"\nand therefore \"no one can discover it anymore\".\n\nThat argument does not hold for the call site in tcp_connect()\n(net/ipv4/tcp_output.c:4327-4332). At that point the socket is in\nTCP_SYN_SENT, has already been inserted into the inet ehash by\ninet_hash_connect() in tcp_v4_connect(), and is therefore very much\ndiscoverable: any softirq running tcp_v4_rcv() on another CPU can take\nthe socket out of the ehash, walk into tcp_inbound_hash(), and load\ntp->ao_info via implicit RCU before bh_lock_sock_nested() is taken on\nthe destroying CPU.\n\nThe reader path then enters __tcp_ao_do_lookup() (net/ipv4/tcp_ao.c:208)\nwhich re-loads tp->ao_info via rcu_dereference_check(); the re-load can\nstill observe the (about-to-be-freed) pointer because there is no\nsynchronize_rcu() between rcu_assign_pointer(tp->ao_info, NULL) and\ntcp_ao_info_free() in tcp_ao_destroy_sock(). The captured pointer is\nthen walked at line 223:\n\n\thlist_for_each_entry_rcu(key, &ao->head, node, ...)\n\nThe writer's synchronous kfree() is free to complete between the line\n218 re-fetch and the line 223 hlist iteration. The slab is reused\n(or simply LIST_POISON1-stamped if not yet reused) and the iteration\nwalks attacker-controlled or poison memory in softirq context.\n\nReproducer (no debug shim, stock x86_64 v7.1-rc2 SMP+KASAN, QEMU+KVM):\nan unprivileged uid=1000 process inside CLONE_NEWUSER|CLONE_NEWNET\ninstalls TCP_MD5SIG + TCP_AO_ADD_KEY on a TCP socket, sprays forged\nTCP-AO segments toward its eventual 4-tuple via raw sockets, then\ncalls connect(). The md5-wins reconciliation in tcp_connect() fires\ntcp_ao_destroy_sock(); the softirq backlog reader on the loopback\nNAPI path crashes on the freed ao->head.first walk:\n\n Oops: general protection fault, probably for non-canonical\n address 0xfbd59c000000002f\n KASAN: maybe wild-memory-access in range\n [0xdead000000000178-0xdead00000000017f]\n CPU: 0 UID: 1000 PID: 100 Comm: repro_userns\n RIP: 0010:__tcp_ao_do_lookup+0x107/0x1c0\n Call Trace: <IRQ>\n __tcp_ao_do_lookup+0x107/0x1c0\n tcp_ao_inbound_lookup.constprop.0+0x12a/0x200\n tcp_inbound_ao_hash+0x5ea/0x1520\n tcp_inbound_hash+0x7ce/0x1240\n tcp_v4_rcv+0x1e7a/0x3e10\n ...\n\nRestore the RCU grace period: re-add struct rcu_head to tcp_ao_info\nand replace the synchronous tcp_ao_info_free() with a call_rcu()\ncallback. Readers that captured tp->ao_info before rcu_assign_pointer\nNULLed it now see the object remain valid until rcu_read_unlock().\nWith the patch applied the reproducer runs cleanly for 2000 iterations\non the same kernel build."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - Forged TCP-AO segments received by the TCP/IP stack reach the stale AO lookup while a mixed TCP-MD5/TCP-AO client socket is connecting. A remote peer can trigger the use-after-free before AO authentication occurs.\nAC:L - Continuous packet spraying across a known or fixed four-tuple can repeatedly cover the short post-ehash connection window. The race is attacker-influenceable and repeatable, including across automatic reconnects.\nPR:N - The stale AO list is traversed before tcp_ao_verify_hash validates the packet, so the remote sender needs neither a valid AO key nor target-system privileges.\nUI:N - No human action is required; an automatically reconnecting network daemon provides the necessary connection lifecycle.\nS:U - The vulnerable TCP-AO objects and resulting memory corruption belong to the same host-kernel security authority.\nC:H - The slab use-after-free permits attacker-influenced traversal of reclaimed list and key objects, potentially enabling arbitrary kernel-memory reads and disclosure.\nI:H - The receive path performs atomic counter writes through stale info or key pointers, and controlled reclamation can provide corruption primitives suitable for control-flow hijacking.\nA:H - The demonstrated race causes a wild-memory access and kernel oops in softirq context, potentially panicking or repeatedly crashing the host."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"include/net/tcp_ao.h",
|
|
"net/ipv4/tcp_ao.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "51e547e8c89c661f6fbede4a28b1d33b13625683",
|
|
"lessThan": "657646c08c94ef7b9dbe468fe7828032216f9841",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "51e547e8c89c661f6fbede4a28b1d33b13625683",
|
|
"lessThan": "4caf12c778fed3dc3824cf36263be5e2c491fbd0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "51e547e8c89c661f6fbede4a28b1d33b13625683",
|
|
"lessThan": "8bc4d43bccbd60efe85d0a44d5bf41762f2f0c30",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"include/net/tcp_ao.h",
|
|
"net/ipv4/tcp_ao.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "6.18",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "6.18",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.39",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.1.4",
|
|
"lessThanOrEqual": "7.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "6.18.39"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "7.1.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "6.18",
|
|
"versionEndExcluding": "7.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/657646c08c94ef7b9dbe468fe7828032216f9841"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4caf12c778fed3dc3824cf36263be5e2c491fbd0"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/8bc4d43bccbd60efe85d0a44d5bf41762f2f0c30"
|
|
}
|
|
],
|
|
"title": "tcp: restore RCU grace period in tcp_ao_destroy_sock",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |