CVE-2021-47248
Assigner: Linux
Published: 2024-05-21T14:19:45.588Z
State: PUBLISHED
descriptions: value: In the Linux kernel, the following vulnerability has been resolved:

udp: fix race between close() and udp_abort()

Kaustubh reported and diagnosed a panic in udp_lib_lookup().
The root cause is udp_abort() racing with close(). Both
racing functions acquire the socket lock, but udp{v6}_destroy_sock()
release it before performing destructive actions.

We can't easily extend the socket lock scope to avoid the race,
instead use the SOCK_DEAD flag to prevent udp_abort from doing
any action when the critical race happens.

Diagnosed-and-tested-by: Kaustubh Pandey <kapandey@codeaurora.org>
affected: product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 5d77dca82839
lessThan: e3c36c773aed
status: affected
versionType: git
version: 5d77dca82839
lessThan: a0882f68f54f
status: affected
versionType: git
version: 5d77dca82839
lessThan: 2f73448041bd
status: affected
versionType: git
version: 5d77dca82839
lessThan: 5a88477c1c85
status: affected
versionType: git
version: 5d77dca82839
lessThan: 8729ec8a2238
status: affected
versionType: git
version: 5d77dca82839
lessThan: 65310b0aff86
status: affected
versionType: git
version: 5d77dca82839
lessThan: a8b897c7bcd4
status: affected
versionType: git
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions: version: 4.9
status: affected
version: 0
lessThan: 4.9
status: unaffected
versionType: custom
version: 4.9.274
lessThanOrEqual: 4.9.*
status: unaffected
versionType: custom
version: 4.14.238
lessThanOrEqual: 4.14.*
status: unaffected
versionType: custom
version: 4.19.196
lessThanOrEqual: 4.19.*
status: unaffected
versionType: custom
version: 5.4.128
lessThanOrEqual: 5.4.*
status: unaffected
versionType: custom
version: 5.10.46
lessThanOrEqual: 5.10.*
status: unaffected
versionType: custom
version: 5.12.13
lessThanOrEqual: 5.12.*
status: unaffected
versionType: custom
version: 5.13
lessThanOrEqual: *
status: unaffected
versionType: original_commit_for_fix
title: udp: fix race between close() and udp_abort()
x_generator: engine: bippy-d175d3acf727