virtio_transport_recv_pkt() first looks up a socket using the full source and destination tuple. If that misses, it falls back to a bound-socket lookup using only the destination address. The fallback is needed for listening and connecting sockets, but it can also select an established socket that remains in the bound table. As a result, a packet from an unrelated source can be dispatched to a non-listening socket. In TCP_SYN_SENT, a source-blind RESPONSE marks the selected socket established while retaining its original remote address. Subsequent RW packets can likewise be delivered through the destination-only fallback. This was reproduced with two capless processes under different UIDs. The attacker discovered the victim tuple through unprivileged AF_VSOCK sock_diag and injected a chosen 16-byte payload into the victim established loopback socket. The legitimate peer received none of those bytes. After taking the socket lock, verify that packets for non-listening sockets come from the peer stored in remote_addr. Listening sockets continue to accept packets from any source. Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Cc: stable@vger.kernel.org Signed-off-by: Daehyeon Ko <4ncienth@gmail.com> --- net/vmw_vsock/virtio_transport_common.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index 8becad812..f73e0406a 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -1822,11 +1822,15 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, lock_sock(sk); - /* Check if sk has been closed or assigned to another transport before - * lock_sock (note: listener sockets are not assigned to any transport) + /* Check if sk has been closed, assigned to another transport, or if the + * packet is from a different peer than the one connected to sk. These + * properties could have changed before lock_sock. Listener sockets are + * not assigned to any transport and accept packets from any peer. */ if (sock_flag(sk, SOCK_DONE) || - (sk->sk_state != TCP_LISTEN && vsk->transport != &t->transport)) { + (sk->sk_state != TCP_LISTEN && + (vsk->transport != &t->transport || + !vsock_addr_equals_addr(&src, &vsk->remote_addr)))) { (void)virtio_transport_reset_no_sock(t, skb, net); release_sock(sk); sock_put(sk); base-commit: 9006c116dd111d457bf5d074990210f70a4ad2c8 -- 2.54.0