In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Don't move a peeked OOB message onto the pending queue
rxrpc_recvmsg_oob() takes a received oob message off recvmsg_oobq and,
if a response is needed, moves it onto the pending_oobq tree. However,
only the unlink from recvmsg_oobq is guarded by MSG_PEEK; the move onto
pending_oobq always runs.
As a result, reading a challenge with MSG_PEEK leaves the skb on
recvmsg_oobq while also adding it to pending_oobq. Since struct
sk_buff's rbnode shares storage with its next and prev pointers,
rb_insert_color() overwrites the list linkage, and the skb, which holds
a single reference, becomes reachable from both queues at once.
When the socket is closed both queues are drained in turn. While
draining recvmsg_oobq, __skb_unlink() follows the next and prev
pointers that rbnode has overwritten and writes to a bad address. Also,
as the skb holds a single reference but is freed from each queue, both
the skb and the connection reference it holds are released twice. This
leads to memory corruption and to a use-after-free caused by the
connection refcount underflow.
MSG_PEEK does not consume the message from the queue, so only unlink it
from recvmsg_oobq and then move it onto pending_oobq or free it when
the message is actually consumed.
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8
AV:N - A remote RxRPC/AFS peer can deliver CHALLENGE packets over UDP to a victim AF_RXRPC client socket; those packets are queued for recvmsg() handling, so the vulnerable rxrpc_recvmsg_oob() path is reached from network-driven authentication traffic rather than purely local-only APIs.
AC:L - An attacker who controls both ends of the connection (or a malicious remote server and a userspace client) can reliably queue a CHALLENGE, call recvmsg(MSG_PEEK) with RXRPC_MANAGE_RESPONSE enabled, then close the socket to trigger duplicate queueing and deterministic double-free/UAF during OOB queue purge.
PR:N - Exploitation requires no privileges on the victim host beyond what any unauthenticated remote RxRPC/AFS server already has to send protocol packets during connection security negotiation; no CAP_NET_ADMIN, root, or namespace-admin capability is needed on the target system.
UI:N - No victim user interaction is required beyond normal automated RxRPC/AFS client operation that receives and processes authentication challenges from a server; the attacker does not need the victim to perform a separate manual action beyond routine client-server communication.
S:U - The corrupted component is kernel RxRPC socket state and the impact is kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as a VM or sandbox breakout.
C:H - The bug leaves one sk_buff referenced from both recvmsg_oobq and pending_oobq, causing double free and rxrpc_connection refcount underflow; this is a use-after-free/memory-corruption primitive that can expose or read freed kernel heap contents.
I:H - rb_insert_color() overwrites sk_buff list linkage shared with rbnode, and socket teardown calls __skb_unlink() on corrupted pointers leading to out-of-bounds writes, enabling control of freed objects and potential arbitrary kernel code execution.
A:H - Closing the socket drains both OOB queues and reliably triggers invalid pointer writes, skb double-free, and connection refcount underflow, producing kernel oops/panic and complete loss of system availability even without full exploitation.
| Attack Vector |
Network |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
None |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:N - A remote RxRPC/AFS peer can deliver CHALLENGE packets over UDP to a victim AF_RXRPC client socket; those packets are queued for recvmsg() handling, so the vulnerable rxrpc_recvmsg_oob() path is reached from network-driven authentication traffic rather than purely local-only APIs.
AC:L - An attacker who controls both ends of the connection (or a malicious remote server and a userspace client) can reliably queue a CHALLENGE, call recvmsg(MSG_PEEK) with RXRPC_MANAGE_RESPONSE enabled, then close the socket to trigger duplicate queueing and deterministic double-free/UAF during OOB queue purge.
PR:N - Exploitation requires no privileges on the victim host beyond what any unauthenticated remote RxRPC/AFS server already has to send protocol packets during connection security negotiation; no CAP_NET_ADMIN, root, or namespace-admin capability is needed on the target system.
UI:N - No victim user interaction is required beyond normal automated RxRPC/AFS client operation that receives and processes authentication challenges from a server; the attacker does not need the victim to perform a separate manual action beyond routine client-server communication.
S:U - The corrupted component is kernel RxRPC socket state and the impact is kernel memory corruption and privilege escalation within the same kernel security authority, not a cross-boundary escape such as a VM or sandbox breakout.
C:H - The bug leaves one sk_buff referenced from both recvmsg_oobq and pending_oobq, causing double free and rxrpc_connection refcount underflow; this is a use-after-free/memory-corruption primitive that can expose or read freed kernel heap contents.
I:H - rb_insert_color() overwrites sk_buff list linkage shared with rbnode, and socket teardown calls __skb_unlink() on corrupted pointers leading to out-of-bounds writes, enabling control of freed objects and potential arbitrary kernel code execution.
A:H - Closing the socket drains both OOB queues and reliably triggers invalid pointer writes, skb double-free, and connection refcount underflow, producing kernel oops/panic and complete loss of system availability even without full exploitation.
CVSS 3.1