In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg() unconditional requeue If rxrpc_recvmsg() fails because MSG_DONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is already queued. The call may be on the queue because MSG_PEEK was also passed and so the call was not dequeued or because the I/O thread requeued it. The unconditional requeue may then corrupt the recvmsg queue, leading to things like UAFs or refcount underruns. Fix this by only requeuing the call if it isn't already on the queue - and moving it to the front if it is already queued. If we don't queue it, we have to put the ref we obtained by dequeuing it. Also, MSG_PEEK doesn't dequeue the call so shouldn't call rxrpc_notify_socket() for the call if we didn't use up all the data on the queue, so fix that also.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: rxrpc: Corrección del reenqueque incondicional de recvmsg() Si rxrpc_recvmsg() falla porque se especificó MSG_DONTWAIT pero la llamada al frente de la cola de recvmsg ya tiene su mutex bloqueado, reenquequea la llamada, esté o no la llamada ya en la cola. La llamada puede estar en la cola porque también se pasó MSG_PEEK y por lo tanto la llamada no fue desencolada o porque el hilo de E/S la reenquequeó. El reenqueque incondicional puede entonces corromper la cola de recvmsg, lo que lleva a cosas como UAFs o subdesbordamientos de refcount. Solucione esto reenquequeando la llamada solo si no está ya en la cola, y moviéndola al frente si ya está en la cola. Si no la encolamos, tenemos que liberar la referencia que obtuvimos al desencolarla. Además, MSG_PEEK no desencola la llamada, por lo que no debería llamar a rxrpc_notify_socket() para la llamada si no consumimos todos los datos de la cola, así que corrija eso también.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-674
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3694e1240> | Operating System |
| linux | linux_kernel | 6.19 | <built-in method update of dict object at 0x7fd3694e2340> | Operating System |
| linux | linux_kernel | 6.19 | <built-in method update of dict object at 0x7fd36b434800> | Operating System |
| linux | linux_kernel | 6.19 | <built-in method update of dict object at 0x7fd2dbc44180> | Operating System |
| linux | linux_kernel | 6.19 | <built-in method update of dict object at 0x7fd3694e0e80> | Operating System |
| linux | linux_kernel | 6.19 | <built-in method update of dict object at 0x7fd3694e2cc0> | Operating System |
| linux | linux_kernel | 6.19 | <built-in method update of dict object at 0x7fd3606a05c0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:* |