Linux Kernel Sockmap Vulnerability in VSOCK Handling

A vulnerability in the Linux kernel's handling of VSOCK (virtual socket) connections within the sockmap feature has been identified. This issue arises because connectible sockets, which are not fully connected, can lose their assigned transport, leading to a null pointer dereference. The problem is exacerbated by the fact that listening VSOCKs should not have any transport assigned, yet a socket can retain a transport during a failed connection attempt, resulting in a listening VSOCK being improperly managed by the sockmap.

Impact

Exploitation of this vulnerability leads to a null pointer dereference, causing a crash in the kernel.

Reproduction

The vulnerability can be reproduced by creating a connectible VSOCK socket that loses its transport assignment, and then allowing it to be managed by the sockmap while in a listening state. This sequence of events triggers the null pointer dereference in the kernel.