Linux Kernel Handshake Request Drainage Vulnerability in Net Namespace Exit

A vulnerability exists in the Linux kernel's handling of netlink-based handshake requests. When a network namespace is destroyed, pending handshake requests that have not been accepted are not properly cleared, leaving references to socket files and allocated memory. This issue arises because the function responsible for draining these requests is not executed, leading to potential memory leaks or corruption. The vulnerability is caused by a reversal in the arguments of a list management function, which disrupts the intended flow of request handling. The problem is further complicated by a race condition that can corrupt the list of requests if a cancellation operation is performed concurrently.

Impact

Failure to properly drain pending handshake requests can lead to memory leaks and potential corruption of data structures, causing instability in the network handling of the application.

Reproduction

The vulnerability can be reproduced by creating pending handshake requests in a netlink-based application and then destroying the network namespace without first clearing those requests. This can be done by initiating a handshake that is not completed, allowing the request to remain pending. Once the request is pending, the network namespace can be destroyed, leaving the request unresolved and causing it to retain references to both a socket file and the associated memory allocation.

Remediation

The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version where this issue has been fixed.