Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved:
sctp: sysctl: auth_enable: avoid using current->nsproxy
As mentioned in a previous commit of this series, using the ’net' structure via ‘current’ is not recommended for different reasons:
-
Inconsistency: getting info from the reader’s/writer’s netns vs only from the opener’s netns.
-
current->nsproxy can be NULL in some cases, resulting in an ‘Oops’ (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The ’net’ structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while ‘sctp.ctl_sock’ still needs to be retrieved from ’net’ structure.
Details
- Affected product:
- AlmaLinux 9.2 ESU , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
- Affected packages:
- linux-hwe @ 4.15.0 (+10 more)
In the Linux kernel, the following vulnerability has been resolved:
sctp: sysctl: auth_enable: avoid using current->nsproxy
As mentioned in a previous commit of this series, using the ’net' structure via ‘current’ is not recommended for different reasons:
-
Inconsistency: getting info from the reader’s/writer’s netns vs only from the opener’s netns.
-
current->nsproxy can be NULL in some cases, resulting in an ‘Oops’ (null-ptr-deref), e.g. when the current task is exiting, as spotted by syzbot [1] using acct(2).
The ’net’ structure can be obtained from the table->data using container_of().
Note that table->data could also be used directly, but that would increase the size of this fix, while ‘sctp.ctl_sock’ still needs to be retrieved from ’net’ structure.