CVE-2024-50154

A use-after-free (UAF) vulnerability was found and fixed in the Linux kernel's TCP subsystem related to request socket (reqsk) timers during handshake handling. This issue stems from a race condition caused by relying on timer_pending() in reqsk_queue_unlink(). This could result in the timer continuing to run after the socket (req->sk) is freed, allowing BPF programs to access invalid memory.

This vulnerability is classified as moderate severity rather than important because the issue primarily affects a narrow set of conditions, notably when BPF programs are involved in tracing TCP retransmissions. In most scenarios, the reqsk timer is pinned and the race condition is unlikely to be triggered. Additionally, the problem only occurs if the request socket (req->sk) is closed while the timer is still pending, which is an uncommon sequence of events. While the potential for a use-after-free (UAF) exists, it requires specific timing and conditions to exploit, limiting its overall risk and impact on typical systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.