PT-2024-6130 · Linux+9 · Linux Kernel+9
Breno Leitao
·
Published
2024-05-10
·
Updated
2025-09-29
·
CVE-2024-38596
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.9-rc7
Description
A data-race condition has been identified in the af unix component of the Linux kernel. This issue occurs because the write function
unix release sock() atomically writes to sk->sk shutdown using WRITE ONCE, but the reader side, unix stream sendmsg(), does not read it atomically. This can cause a KCSAN splat to occur, indicating a data-race in unix release sock and unix stream sendmsg. The issue is related to the unix stream sendmsg() function not being protected by unix state lock(), unlike other reads.Recommendations
To resolve this issue, update the Linux kernel to version 6.9-rc7 or later. As a temporary workaround, consider disabling the
unix stream sendmsg() function until a patch is available. Restrict access to the vulnerable af unix module to minimize the risk of exploitation. Avoid using the sk->sk shutdown variable in the affected API endpoints until the issue is resolved. At the moment, there is no information about additional mitigation measures.Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu