Описание
In the Linux kernel, the following vulnerability has been resolved:
strparser: make sure __strp_recv isn't running before tearing down the parser
The comment above strp_done() claims that if strp is stopped,
strp_recv will no longer be called. That's only true if the caller has
a mechanism (eg locking) to guarantee that strp_recv() calls that
started before strp_stop() have completed by the time we call
strp_done().
This adds a dummy lock_sock/release_sock pair to guarantee that any
in-flight strp_recv() (which runs under either bh_lock_sock or
lock_sock, depending if it's called from ->sk_data_ready or strp_work)
has completed.
Only espintcp can be affected by this race condition, but this patch
makes sure no future user of strp can have the bug.
This could crash on strp->sk ("general mode" of strp), but this mode
has been here for 9 years and has never been used. It'll be gone soon,
no point worrying about it.
Switch the stopped/paused/etc bits to u8's to avoid races between
strp_stop() and strp_pause/unpause().
A reproducer has been published and turns the possible UAF into an
exploit [1].
A flaw was found in the Linux kernel's stream parser component. A race condition occurs when stopping the stream parser while socket receive operations are still actively executing. A local attacker could exploit this timing issue to cause a use-after-free memory error, potentially leading to privilege escalation or a Denial of Service (DoS) via a system crash.
Отчет
This vulnerability is rated as an Important severity flaw because an authenticated local user can leverage a use-after-free condition in the kernel to achieve complete privilege escalation or cause a system crash, without requiring physical access or administrative privileges. Although the underlying race condition specifically affects teardown handling in the stream parser when processing ESP encapsulated over TCP (espintcp) sockets, the resulting memory corruption directly compromises host kernel integrity. Typical Red Hat Enterprise Linux deployments hosting multi-tenant workloads or unprivileged users with local socket access are primarily exposed to this risk.
Меры по смягчению последствий
--- CME Mitigation Guidance (2026-11-02) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to synchronize stream parser teardown with in-flight receive processing and convert parser state flags to independent members to prevent use-after-free conditions: upgrade to the fixed Kernel/Kernel Rt/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds, which adds a lock_sock and release_sock pair in strp_done to wait for active receive processing to finish and converts parser state bitfield flags into u8 members, closing all 2 injection vectors (concurrent socket stream parser teardown during in-flight receive processing, unsynchronized bitfield state updates between parser stop and pause operations). Until patched, this is only a concern on Linux multi-tenant systems or hosts granting unprivileged local users access to create and tear down stream parser sockets such as espintcp — Non-Linux platforms are unaffected — so Restrict unprivileged local user access and constrain process capabilities to prevent unauthorized local users from creating or manipulating espintcp stream parser sockets. As a compensating measure, Enable runtime memory error detection with KASAN or HWASan to detect use-after-free memory errors at runtime using allocation quarantines and redzones, Enable SLAB freelist hardening to randomize freelist allocation order and validate freelist pointer integrity against exploitation, Enforce SELinux in enforcing mode to constrain unprivileged processes and limit post-exploitation actions, Enable KASLR to randomize kernel code locations and impede ROP chain construction, Enable SMEP to prevent the kernel from executing userspace shellcode if control flow is redirected, and Enable SMAP to prevent kernel dereferences of userspace memory structures used to forge freed socket or parser objects. These controls limit blast radius and contain exploitation, but they do not fix the underlying stream parser use-after-free race condition — apply the upstream patch to fully remediate. Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Affected | ||
| Red Hat Enterprise Linux 9 | kernel | Affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Affected |
Показывать по
Дополнительная информация
Статус:
7.8 High
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strp_recv() calls that started before strp_stop() have completed by the time we call strp_done(). This adds a dummy lock_sock/release_sock pair to guarantee that any in-flight strp_recv() (which runs under either bh_lock_sock or lock_sock, depending if it's called from ->sk_data_ready or strp_work) has completed. Only espintcp can be affected by this race condition, but this patch makes sure no future user of strp can have the bug. This could crash on strp->sk ("general mode" of strp), but this mode has been here for 9 years and has never been used. It'll be gone soon, no point worrying about it. Switch the stopped/paused/etc bits to u8's to avoid races between strp_...
In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strp_recv() calls that started before strp_stop() have completed by the time we call strp_done(). This adds a dummy lock_sock/release_sock pair to guarantee that any in-flight strp_recv() (which runs under either bh_lock_sock or lock_sock, depending if it's called from ->sk_data_ready or strp_work) has completed. Only espintcp can be affected by this race condition, but this patch makes sure no future user of strp can have the bug. This could crash on strp->sk ("general mode" of strp), but this mode has been here for 9 years and has never been used. It'll be gone soon, no point worrying about it. Switch the stopped/paused/etc bits to u8's to avoid races between st
strparser: make sure __strp_recv isn't running before tearing down the parser
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strp_recv() calls that started before strp_stop() have completed by the time we call strp_done(). This adds a dummy lock_sock/release_sock pair to guarantee that any in-flight strp_recv() (which runs under either bh_lock_sock or lock_sock, depending if it's called from ->sk_data_ready or strp_work) has completed. Only espintcp can be affected by this race condition, but this patch makes sure no future user of strp can have the bug. This could crash on strp->sk ("general mode" of strp), but this mode has been here for 9 years and has never been used. It'll be gone soon, no point worrying about it. Switch the stopped/paused/etc bits to u8's to avoid races between...
7.8 High
CVSS3