Linux Kernel BPF Verdict Data Ready Race Condition Vulnerability with KTLS

A use-after-free vulnerability has been identified in the Linux kernel's handling of BPF socket verdicts in relation to KTLS (Kernel TLS) processing. This issue arises when a socket is added to a sockmap with a BPF_SK_SKB_VERDICT before the KTLS receive context is established. The BPF socket parser's data ready function can then inadvertently access a freed socket buffer, leading to potential memory corruption.

Impact

Exploitation of this vulnerability causes a use-after-free condition, where a reference to a freed memory object is accessed, potentially leading to arbitrary code execution or memory corruption.

Reproduction

To reproduce this vulnerability, insert a socket into a sockmap with the BPF_SK_SKB_VERDICT option before the KTLS receive context is configured. This can be done by saving the BPF socket verdict data ready function as the received context's saved data ready, which will later be called when data arrives, creating a race condition that drains the socket's receive queue improperly.

Remediation

Users can apply the patch available in the Linux kernel stable tree to address this vulnerability. The patch is included in the official Linux kernel repositories.