Linux Kernel OpenVPN TCP Peer Pointer Caching Vulnerability in ovpn_tcp_close()

A vulnerability exists in the OpenVPN TCP implementation of the Linux kernel, specifically in the ovpn_tcp_close() function. This issue arises because the function improperly manages the peer pointer of the ovpn_socket, leading to a race condition. The vulnerability is present in the Linux kernel stable tree, affecting the OpenVPN TCP transport layer. The problem occurs when ovpn_tcp_close() drops the RCU read lock before safely dereferencing the peer pointer, allowing for potential memory corruption. The issue can be reproduced by triggering a peer removal while simultaneously closing the associated TCP file descriptor.

Impact

Exploitation of this vulnerability can cause a use-after-free condition, where the peer pointer is accessed after the associated memory has been freed, leading to potential memory corruption or arbitrary code execution.

Reproduction

To reproduce this vulnerability, initiate a peer removal process, such as allowing a keepalive timeout to expire or sending a netlink command to delete a peer, at the same time that the OpenVPN client closes the TCP file descriptor associated with that peer. This will create a race condition that triggers the vulnerability by causing ovpn_tcp_close() to drop the RCU read lock before the peer pointer is safely dereferenced.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the Linux Kernel Archives.