CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's TCP implementation, specifically in the `tcp_ao_established_key()` function, where an out-of-bounds access can occur due to improper handling of socket locks in the time-wait state. This issue could potentially lead to system instability or exploitation, making it critical for organizations using Linux-based systems to prioritize patching. System administrators and security teams should assess their environments for affected kernel versions to mitigate any associated risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit. It can be called from tcp_v[46]_timewait_ack() with twsk. Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access. $ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 */ $ pahole -C sock vmlinux | grep sk_lock socket_lock_t sk_lock; /* 440 192 */ Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.