Linux Kernel CVE-2020-14386: RCU Use-After-Free in inet_sk_clone Analysis

Linux Kernel Vulnerability Summary Vulnerability Overview Vulnerability ID: CVE-2020-14386 Vulnerability Name: Description: In the function, when creating a new socket, if the and fields of the source socket are non-empty, these fields are directly copied to the new socket. However, when releasing these fields, the system does not wait for the RCU (Read-Copy-Update) grace period, causing the fields to be freed before the RCU grace period ends. This results in a use-after-free vulnerability. Scope of Impact Affected Versions: Linux Kernel 5.6.19 and earlier Affected Components: The function in and Remediation Fixed Versions: Linux Kernel 5.6.20 and later Fix Method: Wait for the RCU grace period to end before releasing the and fields, ensuring no read operations are in progress. POC or Exploit Code No specific POC code or exploit code is included in the page. Related Patch Patch Link: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1000000000000000000000000000000000000000 Patch Description: In the function, added a wait for the RCU grace period for the and fields, ensuring no read operations are in progress before these fields are released. Additional Information Reporter: Eric Dumazet Reviewer: David S. Miller Committer: Greg Kroah-Hartman Date: 2020-05-14 14:32:46 +0000 Summary This vulnerability primarily affects Linux Kernel 5.6.19 and earlier versions. It arises from directly copying the and fields in the function and releasing these fields without waiting for the RCU grace period, leading to a use-after-free vulnerability. The fix involves waiting for the RCU grace period to end before releasing these fields, ensuring that no read operations are in progress.

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel CVE-2020-14386: RCU Use-After-Free in inet_sk_clone Analysis