Linux Kernel Local Denial of Service in SMC Socket

Executive Summary

This vulnerability exists in the Linux kernel's net/smc component, specifically in the __smc_setsockopt() function. A logic flaw allows a local unprivileged user to cause a Denial of Service (DoS) by holding a socket lock indefinitely.

The issue arises because __smc_setsockopt() calls copy_from_sockptr() while holding the lock_sock(sk) lock. An attacker can pass a userfaultfd-monitored memory page or FUSE-backed memory as the optval, which halts execution during the copy operation and keeps the lock held.

This lock being held indefinitely, combined with asynchronous tear-down operations like shutdown(), exhausts the kernel workqueue (kworkers) and triggers the hung task watchdog, effectively causing a local Denial of Service.

The vulnerability was fixed by moving the user-space copy operation outside the lock_sock() critical section.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a local unprivileged user to cause a Denial of Service (DoS) on the affected Linux system.

By exploiting the flaw, an attacker can hold a socket lock indefinitely, which leads to exhaustion of kernel worker threads and triggers the hung task watchdog. This results in system instability or unresponsiveness.

Such a DoS condition can disrupt normal operations, potentially affecting availability of services running on the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing kernel logs for signs of blocked kernel worker tasks and hung task watchdog triggers related to the smc_shutdown and lock_sock functions.

• Check kernel logs for messages like: "task kworker/u8:2 blocked for more than 120 seconds."
• Look for call traces involving smc_shutdown and lock_sock_nested in dmesg or /var/log/kern.log.
• Use the command: dmesg | grep -i 'kworker.*blocked' to find blocked worker threads.
• Monitor hung task watchdog messages with: dmesg | grep -i 'hung task watchdog'.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation is to apply the patch that moves the user-space copy operation outside the lock_sock() critical section in the __smc_setsockopt() function.

Until the patch is applied, restrict unprivileged users from using the SMC socket options or disable unprivileged userfaultfd usage to reduce the attack surface.

Monitor kernel logs for symptoms of the vulnerability and restart affected services or the system if hung tasks are detected.

Useful 0 Not Useful 0