In the Linux kernel, the following vulnerability has been resolved:
tipc: restrict socket queue dumps in enqueue tracepoints
tipc_sk_enqueue() runs with sk->sk_lock.slock held while the socket is
owned by user context. The spinlock protects the backlog queue in this
path, but it does not serialize against the socket owner consuming or
purging sk_receive_queue.
KASAN reported:
CPU: 14 UID: 0 PID: 1050 Comm: tipc3 Not tainted 7.1.0-rc6+ #126 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x76/0xa0 lib/dump_stack.c:123
print_report+0xce/0x5b0 mm/kasan/report.c:482
kasan_report+0xc6/0x100 mm/kasan/report.c:597
__asan_report_load4_noabort+0x14/0x30 mm/kasan/report_generic.c:380
tipc_skb_dump+0x1327/0x16f0 net/tipc/trace.c:73
tipc_list_dump+0x208/0x2e0 net/tipc/trace.c:187
tipc_sk_dump+0xaf6/0xd60 net/tipc/socket.c:3996
trace_event_raw_event_tipc_sk_class+0x312/0x5a0 net/tipc/trace.h:188
tipc_sk_rcv+0xb1d/0x1d50 net/tipc/socket.c:2497
tipc_node_xmit+0x1c3/0x1440 net/tipc/node.c:1689
__tipc_sendmsg+0x97a/0x1440 net/tipc/socket.c:1512
tipc_sendmsg+0x52/0x80 net/tipc/socket.c:1400
sock_sendmsg+0x2f6/0x3e0 net/socket.c:825
splice_to_socket+0x7f9/0x1010 fs/splice.c:884
do_splice+0xe21/0x2330 fs/splice.c:936
__do_splice+0x153/0x260 fs/splice.c:1431
__x64_sys_splice+0x150/0x230 fs/splice.c:1616
x64_sys_call+0xeb5/0x2790 arch/x86/entry/syscall_64.c:41
do_syscall_64+0xf3/0x620 arch/x86/entry/syscall_64.c:63
entry_SYSCALL_64_after_hwframe+0x76/0x7e arch/x86/entry/entry_64.S:130
RIP: 0033:0x71624e8aafe2
Code: 08 0f 85 71 3a ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66
RSP: 002b:0000716157ffed68 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 0000716157fff6c0 RCX: 000071624e8aafe2
RDX: 000000000000005f RSI: 0000000000000000 RDI: 0000000000000066
RBP: 0000716157ffed90 R08: 0000000000008000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffff00
R13: 0000000000000021 R14: 0000000000000000 R15: 00007fff89799c40
</TASK>
The TIPC_DUMP_ALL tracepoints in tipc_sk_enqueue() also dump
sk_receive_queue and can therefore dereference skbs that the socket
owner has already dequeued or freed. Restrict these dumps to
TIPC_DUMP_SK_BKLGQ, which matches the queue protected by the held
spinlock.
Keep the change limited to the enqueue path, where the unsafe queue dump
is reachable while the socket is owned by user context.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - tipc_sk_enqueue() is invoked from tipc_sk_rcv() on inbound TIPC traffic (tipc_rcv()/tipc_link_rcv() from UDP/Ethernet bearers) and on loopback xmit; a remote cluster peer can deliver packets that hit the enqueue trace path while the destination socket is user-owned.
AC:L - This is a controllable race between enqueue-time TIPC_DUMP_ALL trace dumps of sk_receive_queue and the socket owner dequeuing/freeing those skbs; the attacker drives both sides via concurrent recvmsg/splice/sendmsg threads or by flooding TIPC messages while a receiver holds lock_sock().
PR:N - TIPC data-plane delivery to an existing socket/port needs no authentication or victim credentials; any local user may open AF_TIPC sockets (including via user namespaces with CAP_NET_ADMIN), and default sk_filter sysctl matches all sockets once trace events are enabled.
UI:N - Exploitation needs no victim interaction beyond normal socket/cluster I/O; the attacker controls message injection and thread timing without requiring mounts, prompts, or other deliberate user actions.
S:U - The flaw is a kernel sk_buff use-after-free in the TIPC socket path and its impact stays within the kernel security authority; it does not by itself cross VM, IOMMU, or hypervisor isolation boundaries.
C:H - KASAN reported __asan_report_load4 in tipc_skb_dump() reading freed skb/message fields from sk_receive_queue; this UAF read of attacker-influenced heap objects can disclose kernel memory and supports further info-leak exploitation.
I:H - Concurrent enqueue tracing walks queue pointers while skbs are freed by the socket owner, creating a classic UAF on sk_buff slabs that can be groomed for arbitrary kernel memory corruption and privilege escalation.
A:H - Dereferencing freed skbs during tipc_list_dump()/tipc_skb_dump() can oops or panic the kernel; UAF in the TIPC receive/enqueue path is a high-availability risk even when not fully weaponized for code execution.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - tipc_sk_enqueue() is invoked from tipc_sk_rcv() on inbound TIPC traffic (tipc_rcv()/tipc_link_rcv() from UDP/Ethernet bearers) and on loopback xmit; a remote cluster peer can deliver packets that hit the enqueue trace path while the destination socket is user-owned.
AC:L - This is a controllable race between enqueue-time TIPC_DUMP_ALL trace dumps of sk_receive_queue and the socket owner dequeuing/freeing those skbs; the attacker drives both sides via concurrent recvmsg/splice/sendmsg threads or by flooding TIPC messages while a receiver holds lock_sock().
PR:N - TIPC data-plane delivery to an existing socket/port needs no authentication or victim credentials; any local user may open AF_TIPC sockets (including via user namespaces with CAP_NET_ADMIN), and default sk_filter sysctl matches all sockets once trace events are enabled.
UI:N - Exploitation needs no victim interaction beyond normal socket/cluster I/O; the attacker controls message injection and thread timing without requiring mounts, prompts, or other deliberate user actions.
S:U - The flaw is a kernel sk_buff use-after-free in the TIPC socket path and its impact stays within the kernel security authority; it does not by itself cross VM, IOMMU, or hypervisor isolation boundaries.
C:H - KASAN reported __asan_report_load4 in tipc_skb_dump() reading freed skb/message fields from sk_receive_queue; this UAF read of attacker-influenced heap objects can disclose kernel memory and supports further info-leak exploitation.
I:H - Concurrent enqueue tracing walks queue pointers while skbs are freed by the socket owner, creating a classic UAF on sk_buff slabs that can be groomed for arbitrary kernel memory corruption and privilege escalation.
A:H - Dereferencing freed skbs during tipc_list_dump()/tipc_skb_dump() can oops or panic the kernel; UAF in the TIPC receive/enqueue path is a high-availability risk even when not fully weaponized for code execution.
CVSS 3.1