Patch kernel: backport af_unix UAF fix in unix_stream_data_wait() (torvalds/linux@be309f8eae8b)#17425
Closed
omkhar wants to merge 1696 commits into
Closed
Patch kernel: backport af_unix UAF fix in unix_stream_data_wait() (torvalds/linux@be309f8eae8b)#17425omkhar wants to merge 1696 commits into
omkhar wants to merge 1696 commits into
Conversation
…IGH] - branch main (microsoft#15189) Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…] and CVE-2025-12969 [Medium] - branch main" microsoft#15207 Co-authored-by: BinduSri-6522866 <v-badabala@microsoft.com>
…-66031 [High] and CVE-2025-66030 [Medium] - branch main" microsoft#15208 Co-authored-by: Akhila Guruju <v-guakhila@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
… main" microsoft#15223 Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
…es-base' - branch main" microsoft#15232 Co-authored-by: Pawel Winogrodzki <pawelwi@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…6.52 for CVE-2025-66293 [HIGH] - branch main" microsoft#15234 Co-authored-by: jslobodzian <joslobo@microsoft.com>
…in (microsoft#15229) Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…VE-2025-65637 [HIGH] - branch main" microsoft#15312 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…VE-2025-65637 [HIGH] - branch main" microsoft#15313 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…VE-2025-65637 [HIGH] - branch main" microsoft#15314 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
…-2025-65637 [HIGH] - branch main" microsoft#15315 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…65637 [HIGH] - branch main" microsoft#15316 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…2025-65637 [HIGH] - branch main" microsoft#15317 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…VE-2025-65637 [HIGH] - branch main" microsoft#15318 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…VE-2025-66293 [HIGH] - branch main" microsoft#15319 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>
…-2025-65637 [HIGH] - branch main" microsoft#15320 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…025-65637 [HIGH] - branch main" microsoft#15321 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…VE-2025-65637 [HIGH] - branch main" microsoft#15322 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
…- branch main" microsoft#15323 Co-authored-by: Ratiranjan5 <v-ratbehera@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
….66 for CVE-2025-55753, CVE-2025-58098, CVE-2025-59775, CVE-2025-65082, CVE-2025-66200 [High] - branch main" microsoft#15324 Co-authored-by: jslobodzian <joslobo@microsoft.com>
…-2025-65637 [HIGH] - branch main" microsoft#15325 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…rovider for CVE-2025-65637 [HIGH] - branch main" microsoft#15326 Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: jslobodzian <joslobo@microsoft.com>
…026-1965 [MEDIUM] (microsoft#16207) Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
…[MEDIUM] (microsoft#16354) Co-authored-by: SumitJenaHCL <v-sumitjena@microsoft.com>
…-68146 [MEDIUM] (microsoft#16212) Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>
…[HIGH] - branch main (microsoft#16860) Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
…[HIGH] - branch main (microsoft#16863) Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
…VE-2025-49010 [LOW] (microsoft#16452) Co-authored-by: Ratiranjan Behera <v-ratbehera@microsoft.com>
…E-2026-32776 [MEDIUM] (microsoft#16229) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: Aditya Singh <v-aditysing@microsoft.com>
…6004) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>
…16647) Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
…-2026-0965, CVE-2026-0964, CVE-2026-3731 [MEDIUM] (microsoft#16409) Co-authored-by: Aditya Singh <v-aditysing@microsoft.com>
…icrosoft#16432) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com> Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
…rvalds/linux@be309f8eae8b) Upstream's Cc: stable@vger.kernel.org # 6.5.x explicitly excludes 5.15. The race upstream removes existed on 5.15 because unix_stream_sendpage() could grow the receiver tail skb (commit 869e7c62486e). On 5.15 we cannot simply remove the last_len check (would re-introduce sendpage-grows-last-skb race); instead we make the read SAFE by taking sk_receive_queue.lock. +5/-2 lines. unix_stream_data_wait grew +80 bytes; +1 spin_lock callsite + +2 KASAN store-checks confirm the design. LTP suite (66 tests, 41 AF_UNIX-touching): 0 new failures patched vs baseline. Signed-off-by: omkhar <omkhar@linkedin.com>
5 tasks
microsoft-github-policy-service
Bot
added
specs-extended
Author
|
Closing — this is a Mariner 2.0 kernel backport (head branch is Holding on opening the equivalent PR on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
17 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport af_unix UAF fix from torvalds/linux@be309f8.
Upstream: Author Jann Horn jannh@google.com (Google Project Zero). Reviewed-by Kuniyuki Iwashima. Signed-off-by chain Jann → Jakub Kicinski. Cc: stable@vger.kernel.org # 6.5.x. Fixes: 2b514574f7e8.
Backport type: CUSTOM 5.15 backport. Upstream's
Cc: stable@vger.kernel.org # 6.5.xexplicitly excludes 5.15 because unix_stream_sendpage() on 5.15 can still grow the receiver tail skb (commit 869e7c62486e). We cannot simply remove the last_len check on 5.15 (would re-introduce sendpage-grows-last-skb race). Instead we SERIALIZE the read by taking sk->sk_receive_queue.lock around skb_peek_tail() + tail->len read. +5/-2 lines, contained in unix_stream_data_wait().Code-correctness: unix_stream_data_wait +80 bytes (within +30–100 expected range for the added locking). +1 spin_lock callsite. +2 KASAN store-checks for the lock writes. All deltas match the design spec.
LTP regression: 66 tests (41 AF_UNIX-touching). Baseline 242/11/2 = patched 242/11/2. 0 patch-induced regressions. The 4 failing test families (dnsmasq_tests, ping01, sendfile01, tracepath01) are environmental (no peer on 10.0.0.1) and identical on both sides.
Mariner 2.0 caveat: AKS EOL 2025-11-30; PR for non-AKS consumers.