Linux kernel bpf/sockmap: SKB refcount race gives use-after-free in the backlog worker

Impact

A sockmap-attached socket can hand an SKB to the ingress message queue and let userspace consume and free it while the sk_psock_backlog worker still holds the pointer, producing a use-after-free dequeued in kernel workqueue context (observed as a general protection fault in skb_dequeue). Sockmap is used by Cilium and other eBPF dataplanes that commonly run on GPU clusters, so the vulnerable path is live on nodes using eBPF socket acceleration. A local attacker able to load or exercise sockmap programs gets kernel-memory corruption on a shared node; at minimum it is a host crash that takes every tenant pod with it.

Who can reach it

Local, requires the ability to drive a sockmap-attached socket - in practice a privileged dataplane component or a user with CAP_BPF/CAP_NET_ADMIN, or any workload whose traffic traverses an existing sockmap. Not remotely reachable on its own.

What to do

Update to a stable kernel containing the skb_get() fix (commits 65ad600b9bde, 923877254f00, a454d84ee20b, e6b5e47adb91) and reboot each node. As an interim mitigation, disable sockmap-based socket acceleration in the CNI (for Cilium, the socket-level load balancing / sockops features) - this costs throughput but removes the path without a reboot.

References

Related entries

• Linux kernel sched/psi: use-after-free when a cgroup is removed under a poll() on its pressure fileCVE-2023-54019 · Linux kernel sched/psi (cgroup pressure-stall trigger polling)High
• Linux kernel crypto/essiv: EBUSY from a backlogged request frees live data, giving a use-after-freeCVE-2023-54046 · Linux kernel crypto essiv template (MAY_BACKLOG EBUSY handling)High
• Linux kernel bpf: preemption left enabled in bpf_event_output corrupts shared perf sample bufferCVE-2023-54173 · Linux kernel BPF (bpf_event_output preemption)High
• Linux i915 GPU kernel driver: A use-after-free in the i915 GPU kernel driver. The general shape is that a GPU object isCVE-2023-54202 · Linux i915 GPU kernel driverHigh
• Linux kernel (netfilter pipapo): Inactive elements mishandled in nft_pipapo_walk - use-after-free, local rootCVE-2023-6817 · Linux kernel (netfilter pipapo)High
• Linux kernel (io_uring): Page use-after-free via io_uring buffer-ring mmap - unprivileged local user to rootCVE-2024-0582 · Linux kernel (io_uring)High