Linux Kernel Netlink Handshake Request File Reference Vulnerability

A vulnerability in the Linux kernel's netlink handshake handling can lead to use-after-free issues. This occurs when a request is processed and the associated file reference is released before it can be safely used, allowing for the possibility of reading null or accessing freed memory. The issue arises because the file and socket structures are managed independently, creating a window where the file reference can be prematurely released. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can cause use-after-free conditions, leading to potential null pointer dereferences or access to freed memory, which can be exploited to execute arbitrary code or cause a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by simulating a netlink handshake request and then canceling it before the request is fully processed. This can be done by invoking the 'tls_handshake_cancel' function, which releases the file reference associated with the handshake request, creating a race condition that the accept-side code does not properly handle.

Remediation

Users can upgrade to the latest version of the Linux kernel stable tree, where this vulnerability has been addressed.