Bug 1226874 (CVE-2024-36489) - VUL-0: CVE-2024-36489: kernel: tls: fix missing memory barrier in tls_init
Summary: VUL-0: CVE-2024-36489: kernel: tls: fix missing memory barrier in tls_init
Status: NEW
Alias: CVE-2024-36489
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Davide Benini
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/411750/
Whiteboard: CVSSv3.1:SUSE:CVE-2024-36489:4.7:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2024-06-24 10:38 UTC by SMASH SMASH
Modified: 2024-06-25 12:09 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2024-06-24 10:38:58 UTC
In the Linux kernel, the following vulnerability has been resolved:

tls: fix missing memory barrier in tls_init

In tls_init(), a write memory barrier is missing, and store-store
reordering may cause NULL dereference in tls_{setsockopt,getsockopt}.

CPU0                               CPU1
-----                              -----
// In tls_init()
// In tls_ctx_create()
ctx = kzalloc()
ctx->sk_proto = READ_ONCE(sk->sk_prot) -(1)

// In update_sk_prot()
WRITE_ONCE(sk->sk_prot, tls_prots)     -(2)

                                   // In sock_common_setsockopt()
                                   READ_ONCE(sk->sk_prot)->setsockopt()

                                   // In tls_{setsockopt,getsockopt}()
                                   ctx->sk_proto->setsockopt()    -(3)

In the above scenario, when (1) and (2) are reordered, (3) can observe
the NULL value of ctx->sk_proto, causing NULL dereference.

To fix it, we rely on rcu_assign_pointer() which implies the release
barrier semantic. By moving rcu_assign_pointer() after ctx->sk_proto is
initialized, we can ensure that ctx->sk_proto are visible when
changing sk->sk_prot.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-36489
https://www.cve.org/CVERecord?id=CVE-2024-36489
https://git.kernel.org/stable/c/2c260a24cf1c4d30ea3646124f766ee46169280b
https://git.kernel.org/stable/c/335c8f1566d8e44c384d16b450a18554896d4e8b
https://git.kernel.org/stable/c/91e61dd7a0af660408e87372d8330ceb218be302
https://git.kernel.org/stable/c/ab67c2fd3d070a21914d0c31319d3858ab4e199c
https://git.kernel.org/stable/c/d72e126e9a36d3d33889829df8fc90100bb0e071
https://git.kernel.org/stable/c/ef21007a7b581c7fe64d5a10c320880a033c837b
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2024/CVE-2024-36489.mbox
https://bugzilla.redhat.com/show_bug.cgi?id=2293687