Race Condition in Linux Kernel IPC Shared Memory

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by properly serializing orphan cleanup with shm_nattch updates. To mitigate this vulnerability, you should update your Linux kernel to the version that includes this fix.

• Apply the latest Linux kernel update or patch that addresses the ipc/shm serialization issue.
• Avoid using unpatched kernel versions that may improperly handle shared memory segment cleanup.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's inter-process communication (IPC) shared memory (shm) subsystem. Specifically, the issue involves improper serialization during the cleanup of orphaned shared memory segments. The function shm_destroy_orphaned() walks through shared memory IDs under a read-write semaphore (rwsem), but it does not properly synchronize all fields checked by shm_may_destroy(). The field shm_nattch, which tracks the number of attachments to a shared memory segment, is updated while holding a different lock (shm_perm.lock), and some attach operations update this field without holding the rwsem. This can lead to a race condition where an orphaned shared memory segment might be incorrectly considered unused and destroyed prematurely. The fix involves moving the shm_may_destroy() check under the shm_perm.lock to ensure proper locking and prevent premature removal.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to premature destruction of shared memory segments that are still in use. Such a race condition may cause instability or unexpected behavior in applications relying on shared memory for communication or data storage. It could result in data corruption, application crashes, or denial of service if critical shared memory segments are removed while still attached by processes.

Useful 0 Not Useful 0