In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and …
High CVSS 7.8
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: Update unix_sk(sk)->oob_skb under sk_receive_queue lock. Billy Jheng Bing-Jhong reported a race between __unix_gc() and queue_oob(). __unix_gc() tries to garbage-collect close()d inflight sockets, and then if the socket has MSG_OOB in unix_sk(sk)->oob_skb, GC will drop the reference and set NULL to it locklessly. However, the peer socket still can send MSG_OOB message and queue_oob() can update unix_sk(sk)->oob_skb…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3 Patch
- https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1 Patch
- https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 Patch
- https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2 Patch
- https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636 Patch
- https://git.kernel.org/stable/c/4708f49add84a57ce0ccc7bf9a6269845c631cc3 Patch
- https://git.kernel.org/stable/c/4bf6964451c3cb411fbaa1ae8b214b3d97a59bf1 Patch
- https://git.kernel.org/stable/c/518a994aa0b87d96f1bc6678a7035df5d1fcd7a1 Patch
- https://git.kernel.org/stable/c/9841991a446c87f90f66f4b9fee6fe934c1336a2 Patch
- https://git.kernel.org/stable/c/d59ae9314b97e01c76a4171472441e55721ba636 Patch
Timeline
- nvd_ingest NVD