Buffer Overflow in Linux Kernel vsock/vmci

Executive Summary

This vulnerability exists in the Linux kernel's vsock/vmci component. It occurs because when the function vmci_transport_recv_connecting_server() returns an error, the subsequent call to vsock_remove_pending() does not properly balance the socket backlog counters by calling sk_acceptq_removed(). This causes the sk_ack_backlog counter to increase permanently.

Repeated handshake failures, such as those caused by malformed packets or allocation failures, cause the sk_ack_backlog to grow until it reaches its maximum limit (sk_max_ack_backlog). Once this limit is reached, the listener refuses all new connections silently by returning an ECONNREFUSED error, effectively causing a denial of service that requires restarting the process to recover.

The fix involves ensuring that sk_acceptq_added() and sk_acceptq_removed() calls are balanced even on error paths to prevent the backlog from permanently increasing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service condition on systems using the affected Linux kernel vsock/vmci component. Specifically, repeated handshake failures can cause the socket backlog to fill up and permanently refuse new incoming connections.

As a result, services relying on these connections will become unavailable until the affected process is restarted, potentially causing downtime and disruption.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability causes a permanent increment of sk_ack_backlog on repeated handshake failures, leading to a silent denial of service where the listener refuses new connections until the process is restarted.

An immediate mitigation step is to restart the affected process to recover from the denial of service condition.

For a permanent fix, update the Linux kernel to a version where the issue is resolved by balancing sk_acceptq_added() with sk_acceptq_removed() on the error path in the vsock/vmci code.

Useful 0 Not Useful 0