CVE-2023-52986

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener<br /> <br /> A listening socket linked to a sockmap has its sk_prot overridden. It<br /> points to one of the struct proto variants in tcp_bpf_prots. The variant<br /> depends on the socket&amp;#39;s family and which sockmap programs are attached.<br /> <br /> A child socket cloned from a TCP listener initially inherits their sk_prot.<br /> But before cloning is finished, we restore the child&amp;#39;s proto to the<br /> listener&amp;#39;s original non-tcp_bpf_prots one. This happens in<br /> tcp_create_openreq_child -&gt; tcp_bpf_clone.<br /> <br /> Today, in tcp_bpf_clone we detect if the child&amp;#39;s proto should be restored<br /> by checking only for the TCP_BPF_BASE proto variant. This is not<br /> correct. The sk_prot of listening socket linked to a sockmap can point to<br /> to any variant in tcp_bpf_prots.<br /> <br /> If the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then<br /> the child socket unintentionally is left if the inherited sk_prot by<br /> tcp_bpf_clone.<br /> <br /> This leads to issues like infinite recursion on close [1], because the<br /> child state is otherwise not set up for use with tcp_bpf_prot operations.<br /> <br /> Adjust the check in tcp_bpf_clone to detect all of tcp_bpf_prots variants.<br /> <br /> Note that it wouldn&amp;#39;t be sufficient to check the socket state when<br /> overriding the sk_prot in tcp_bpf_update_proto in order to always use the<br /> TCP_BPF_BASE variant for listening sockets. Since commit<br /> b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage")<br /> it is possible for a socket to transition to TCP_LISTEN state while already<br /> linked to a sockmap, e.g. connect() -&gt; insert into map -&gt;<br /> connect(AF_UNSPEC) -&gt; listen().<br /> <br /> [1]: https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/