{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-56664", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T15:00:39.844Z", "datePublished": "2024-12-27T15:06:26.276Z", "dateUpdated": "2026-08-05T11:45:58.455Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:58.455Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix race between element replace and close()\n\nElement replace (with a socket different from the one stored) may race\nwith socket's close() link popping & unlinking. __sock_map_delete()\nunconditionally unrefs the (wrong) element:\n\n// set map[0] = s0\nmap_update_elem(map, 0, s0)\n\n// drop fd of s0\nclose(s0)\n sock_map_close()\n lock_sock(sk) (s0!)\n sock_map_remove_links(sk)\n link = sk_psock_link_pop()\n sock_map_unlink(sk, link)\n sock_map_delete_from_link\n // replace map[0] with s1\n map_update_elem(map, 0, s1)\n sock_map_update_elem\n (s1!) lock_sock(sk)\n sock_map_update_common\n psock = sk_psock(sk)\n spin_lock(&stab->lock)\n osk = stab->sks[idx]\n sock_map_add_link(..., &stab->sks[idx])\n sock_map_unref(osk, &stab->sks[idx])\n psock = sk_psock(osk)\n sk_psock_put(sk, psock)\n if (refcount_dec_and_test(&psock))\n sk_psock_drop(sk, psock)\n spin_unlock(&stab->lock)\n unlock_sock(sk)\n __sock_map_delete\n spin_lock(&stab->lock)\n sk = *psk // s1 replaced s0; sk == s1\n if (!sk_test || sk_test == sk) // sk_test (s0) != sk (s1); no branch\n sk = xchg(psk, NULL)\n if (sk)\n sock_map_unref(sk, psk) // unref s1; sks[idx] will dangle\n psock = sk_psock(sk)\n sk_psock_put(sk, psock)\n if (refcount_dec_and_test())\n sk_psock_drop(sk, psock)\n spin_unlock(&stab->lock)\n release_sock(sk)\n\nThen close(map) enqueues bpf_map_free_deferred, which finally calls\nsock_map_free(). This results in some refcount_t warnings along with\na KASAN splat [1].\n\nFix __sock_map_delete(), do not allow sock_map_unref() on elements that\nmay have been replaced.\n\n[1]:\nBUG: KASAN: slab-use-after-free in sock_map_free+0x10e/0x330\nWrite of size 4 at addr ffff88811f5b9100 by task kworker/u64:12/1063\n\nCPU: 14 UID: 0 PID: 1063 Comm: kworker/u64:12 Not tainted 6.12.0+ #125\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014\nWorkqueue: events_unbound bpf_map_free_deferred\nCall Trace:\n \n dump_stack_lvl+0x68/0x90\n print_report+0x174/0x4f6\n kasan_report+0xb9/0x190\n kasan_check_range+0x10f/0x1e0\n sock_map_free+0x10e/0x330\n bpf_map_free_deferred+0x173/0x320\n process_one_work+0x846/0x1420\n worker_thread+0x5b3/0xf80\n kthread+0x29e/0x360\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x1a/0x30\n \n\nAllocated by task 1202:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n __kasan_slab_alloc+0x85/0x90\n kmem_cache_alloc_noprof+0x131/0x450\n sk_prot_alloc+0x5b/0x220\n sk_alloc+0x2c/0x870\n unix_create1+0x88/0x8a0\n unix_create+0xc5/0x180\n __sock_create+0x241/0x650\n __sys_socketpair+0x1ce/0x420\n __x64_sys_socketpair+0x92/0x100\n do_syscall_64+0x93/0x180\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFreed by task 46:\n kasan_save_stack+0x1e/0x40\n kasan_save_track+0x10/0x30\n kasan_save_free_info+0x37/0x60\n __kasan_slab_free+0x4b/0x70\n kmem_cache_free+0x1a1/0x590\n __sk_destruct+0x388/0x5a0\n sk_psock_destroy+0x73e/0xa50\n process_one_work+0x846/0x1420\n worker_thread+0x5b3/0xf80\n kthread+0x29e/0x360\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x1a/0x30\n\nThe bu\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Both halves of the race are local syscalls — `bpf(BPF_MAP_UPDATE_ELEM)` on a sockmap fd and `close()` on a sockmap'd socket — with no remote peer data involved in reaching `__sock_map_delete()`. Sockmap element replace and socket teardown are driven entirely from the local host.\nAC:L - The attacker controls both sides of the race, running one thread looping `close()` on sockmap'd sockets and another looping `map_update_elem()` to replace the same index, so the window is created and retried by the attacker rather than depending on any external condition. Nothing about the race depends on victim state or memory layout the attacker cannot influence, and the reporter reproduced it with a KASAN splat.\nPR:L - Creating the sockmap requires `CAP_NET_ADMIN`, but `bpf_token_capable()` grants it at `ns_capable()` level inside a user namespace via delegated BPF tokens, and `CAP_NET_ADMIN` is routinely handed to container and network-agent workloads. Once the map fd exists, `map_update_elem()` and `close()` need no further privilege, so an ordinary unprivileged-in-init-ns user reaches this path.\nUI:N - The attacker creates the sockmap, inserts its own sockets, and drives both racing threads entirely on its own. No victim action — no mount, no file open, no third-party interaction — is required.\nS:U - The refcount underflow, premature `sk_psock_drop()`, and resulting use-after-free are all confined to kernel memory and the socket/psock state managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stray `sock_map_unref()` frees the `struct sock` while `stab->sks[idx]` retains a dangling pointer, letting the attacker reclaim the freed slab object with controlled data and then read it back through `sock_map_lookup_sys()`/`__sock_gen_cookie()` or a `bpf_sk_redirect_map()` datapath dereference. A use-after-free on a `struct sock` exposes its `sk_prot`, callbacks, and adjacent heap contents, giving an arbitrary-read primitive.\nI:H - `sock_map_free()` performs a 4-byte use-after-free *write* into the freed socket (the KASAN splat) and `lock_sock()` on freed memory, while the torn link means the map keeps referencing a destroyed socket whose `sk_prot` function pointers are dereferenced on later redirect/lookup. Combined with the attacker-chosen reclaim window on the 1984-byte slab, this is a heap write and control-flow hijack primitive, not a bounded corruption.\nA:H - The bug produces `refcount_t` addition-on-zero and underflow warnings plus a KASAN slab-use-after-free in `sock_map_free()`, and the freed socket is later locked and dereferenced from a workqueue — with panic_on_warn or panic_on_oops this is an immediate kernel panic, and otherwise an oops in `bpf_map_free_deferred`. The attacker can retrigger it at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/sock_map.c" ], "versions": [ { "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "6deb9e85dc9a2ba4414b91c1b5b00b8415910890", "status": "affected", "versionType": "git" }, { "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "fdb2cd8957ac51f84c9e742ba866087944bb834b", "status": "affected", "versionType": "git" }, { "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "b79a0d1e9a374d1b376933a354c4fcd01fce0365", "status": "affected", "versionType": "git" }, { "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "b015f19fedd2e12283a8450dd0aefce49ec57015", "status": "affected", "versionType": "git" }, { "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "bf2318e288f636a882eea39f7e1015623629f168", "status": "affected", "versionType": "git" }, { "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "ed1fc5d76b81a4d681211333c026202cad4d5649", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/sock_map.c" ], "versions": [ { "version": "4.20", "status": "affected" }, { "version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.236", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.180", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.125", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.67", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.6", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.236" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.180" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.125" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.67" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.13" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6deb9e85dc9a2ba4414b91c1b5b00b8415910890" }, { "url": "https://git.kernel.org/stable/c/fdb2cd8957ac51f84c9e742ba866087944bb834b" }, { "url": "https://git.kernel.org/stable/c/b79a0d1e9a374d1b376933a354c4fcd01fce0365" }, { "url": "https://git.kernel.org/stable/c/b015f19fedd2e12283a8450dd0aefce49ec57015" }, { "url": "https://git.kernel.org/stable/c/bf2318e288f636a882eea39f7e1015623629f168" }, { "url": "https://git.kernel.org/stable/c/ed1fc5d76b81a4d681211333c026202cad4d5649" } ], "title": "bpf, sockmap: Fix race between element replace and close()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html" }, { "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:52:13.123Z" } } ] } }