Re: CVE-2024-27429: netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser

[Michal Hocko]

This and couple of others are all having the same pattern. Adding
READ_ONCE for an integer value with a claim that this might race with
sysctl updates. While the claim about the race is correct I fail to see
how this could have any security consequences. Even if a partial write
was observed which sounds _more_ than theoretical these all are merely
timeouts and delays.

Is there anything I am missing?

On Fri 17-05-24 14:02:29, Greg KH wrote:
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser
> 
> We need to protect the reader reading the sysctl value
> because the value can be changed concurrently.
> 
> The Linux kernel CVE team has assigned CVE-2024-27429 to this issue.
> 
> 
> Affected and fixed versions
> ===========================
> 
> 	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 4.19.310 with commit e3a3718b1723
> 	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 5.4.272 with commit 1e84b108f2a7
> 	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 5.10.213 with commit 18c95d11c347
> 	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 5.15.152 with commit b3f0bc3a315c
> 	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.1.82 with commit e439607291c0
> 	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.6.22 with commit 7e1e25891f09
> 	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.7.10 with commit 591192c3a9fc
> 	Issue introduced in 2.6.12 with commit 1da177e4c3f4 and fixed in 6.8 with commit cfd9f4a740f7
> 
> Please see https://www.kernel.org for a full list of currently supported
> kernel versions by the kernel community.
> 
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions.  The official CVE entry at
> 	https://cve.org/CVERecord/?id=CVE-2024-27429
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
> 
> 
> Affected files
> ==============
> 
> The file(s) affected by this issue are:
> 	net/netrom/nr_route.c
> 
> 
> Mitigation
> ==========
> 
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes.  Individual
> changes are never tested alone, but rather are part of a larger kernel
> release.  Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all.  If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> 	https://git.kernel.org/stable/c/e3a3718b1723253d4f068e88e81d880d71f1a1e9
> 	https://git.kernel.org/stable/c/1e84b108f2a71daa8d04032e4d2096522376debb
> 	https://git.kernel.org/stable/c/18c95d11c347a12e5c31df1325cef6b995d14ecf
> 	https://git.kernel.org/stable/c/b3f0bc3a315cf1af03673a0163c08fe037587acd
> 	https://git.kernel.org/stable/c/e439607291c082332e1e35baf8faf8552e6bcb4a
> 	https://git.kernel.org/stable/c/7e1e25891f090e24a871451c9403abac63cb45dd
> 	https://git.kernel.org/stable/c/591192c3a9fc728a0af7b9dd50bf121220062293
> 	https://git.kernel.org/stable/c/cfd9f4a740f772298308b2e6070d2c744fb5cf79

-- 
Michal Hocko
SUSE Labs