5.5
MEDIUM
CVE-2024-41006
Netrom Linux Memory Leak Fix
Description

In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nr_heartbeat_expiry() syzbot reported a memory leak in nr_create() [0]. Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.") added sock_hold() to the nr_heartbeat_expiry() function, where a) a socket has a SOCK_DESTROY flag or b) a listening socket has a SOCK_DEAD flag. But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor has already been closed and the nr_release() function has been called. So it makes no sense to hold the reference count because no one will call another nr_destroy_socket() and put it as in the case "b." nr_connect nr_establish_data_link nr_start_heartbeat nr_release switch (nr->state) case NR_STATE_3 nr->state = NR_STATE_2 sock_set_flag(sk, SOCK_DESTROY); nr_rx_frame nr_process_rx_frame switch (nr->state) case NR_STATE_2 nr_state2_machine() nr_disconnect() nr_sk(sk)->state = NR_STATE_0 sock_set_flag(sk, SOCK_DEAD) nr_heartbeat_expiry switch (nr->state) case NR_STATE_0 if (sock_flag(sk, SOCK_DESTROY) || (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) sock_hold() // ( !!! ) nr_destroy_socket() To fix the memory leak, let's call sock_hold() only for a listening socket. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller. [0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16

INFO

Published Date :

July 12, 2024, 1:15 p.m.

Last Modified :

Aug. 21, 2024, 5:20 p.m.

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remotely Exploitable :

No

Impact Score :

3.6

Exploitability Score :

1.8
Affected Products

The following products are affected by CVE-2024-41006 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-41006.

URL Resource
https://git.kernel.org/stable/c/0b9130247f3b6a1122478471ff0e014ea96bb735 Mailing List Patch
https://git.kernel.org/stable/c/280cf1173726a7059b628c610c71050d5c0b6937 Mailing List Patch
https://git.kernel.org/stable/c/5391f9db2cab5ef1cb411be1ab7dbec728078fba Mailing List Patch
https://git.kernel.org/stable/c/a02fd5d775cf9787ee7698c797e20f2fa13d2e2b Mailing List Patch
https://git.kernel.org/stable/c/b6ebe4fed73eedeb73f4540f8edc4871945474c8 Mailing List Patch
https://git.kernel.org/stable/c/d377f5a28332954b19e373d36823e59830ab1712 Mailing List Patch
https://git.kernel.org/stable/c/d616876256b38ecf9a1a1c7d674192c5346bc69c Mailing List Patch
https://git.kernel.org/stable/c/e07a9c2a850cdebf625e7a1b8171bd23a8554313 Mailing List Patch

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-41006 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2024-41006 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Aug. 21, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
    Changed Reference Type https://git.kernel.org/stable/c/0b9130247f3b6a1122478471ff0e014ea96bb735 No Types Assigned https://git.kernel.org/stable/c/0b9130247f3b6a1122478471ff0e014ea96bb735 Mailing List, Patch
    Changed Reference Type https://git.kernel.org/stable/c/280cf1173726a7059b628c610c71050d5c0b6937 No Types Assigned https://git.kernel.org/stable/c/280cf1173726a7059b628c610c71050d5c0b6937 Mailing List, Patch
    Changed Reference Type https://git.kernel.org/stable/c/5391f9db2cab5ef1cb411be1ab7dbec728078fba No Types Assigned https://git.kernel.org/stable/c/5391f9db2cab5ef1cb411be1ab7dbec728078fba Mailing List, Patch
    Changed Reference Type https://git.kernel.org/stable/c/a02fd5d775cf9787ee7698c797e20f2fa13d2e2b No Types Assigned https://git.kernel.org/stable/c/a02fd5d775cf9787ee7698c797e20f2fa13d2e2b Mailing List, Patch
    Changed Reference Type https://git.kernel.org/stable/c/b6ebe4fed73eedeb73f4540f8edc4871945474c8 No Types Assigned https://git.kernel.org/stable/c/b6ebe4fed73eedeb73f4540f8edc4871945474c8 Mailing List, Patch
    Changed Reference Type https://git.kernel.org/stable/c/d377f5a28332954b19e373d36823e59830ab1712 No Types Assigned https://git.kernel.org/stable/c/d377f5a28332954b19e373d36823e59830ab1712 Mailing List, Patch
    Changed Reference Type https://git.kernel.org/stable/c/d616876256b38ecf9a1a1c7d674192c5346bc69c No Types Assigned https://git.kernel.org/stable/c/d616876256b38ecf9a1a1c7d674192c5346bc69c Mailing List, Patch
    Changed Reference Type https://git.kernel.org/stable/c/e07a9c2a850cdebf625e7a1b8171bd23a8554313 No Types Assigned https://git.kernel.org/stable/c/e07a9c2a850cdebf625e7a1b8171bd23a8554313 Mailing List, Patch
    Added CWE NIST CWE-401
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.19.272 up to (excluding) 4.19.317 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.231 up to (excluding) 5.4.279 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.166 up to (excluding) 5.10.221 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.91 up to (excluding) 5.15.162 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.9 up to (excluding) 6.1.96 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.9.7 *cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:*
  • CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jul. 12, 2024

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nr_heartbeat_expiry() syzbot reported a memory leak in nr_create() [0]. Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.") added sock_hold() to the nr_heartbeat_expiry() function, where a) a socket has a SOCK_DESTROY flag or b) a listening socket has a SOCK_DEAD flag. But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor has already been closed and the nr_release() function has been called. So it makes no sense to hold the reference count because no one will call another nr_destroy_socket() and put it as in the case "b." nr_connect nr_establish_data_link nr_start_heartbeat nr_release switch (nr->state) case NR_STATE_3 nr->state = NR_STATE_2 sock_set_flag(sk, SOCK_DESTROY); nr_rx_frame nr_process_rx_frame switch (nr->state) case NR_STATE_2 nr_state2_machine() nr_disconnect() nr_sk(sk)->state = NR_STATE_0 sock_set_flag(sk, SOCK_DEAD) nr_heartbeat_expiry switch (nr->state) case NR_STATE_0 if (sock_flag(sk, SOCK_DESTROY) || (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) sock_hold() // ( !!! ) nr_destroy_socket() To fix the memory leak, let's call sock_hold() only for a listening socket. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller. [0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16
    Added Reference kernel.org https://git.kernel.org/stable/c/d616876256b38ecf9a1a1c7d674192c5346bc69c [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/e07a9c2a850cdebf625e7a1b8171bd23a8554313 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/5391f9db2cab5ef1cb411be1ab7dbec728078fba [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/280cf1173726a7059b628c610c71050d5c0b6937 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/a02fd5d775cf9787ee7698c797e20f2fa13d2e2b [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/b6ebe4fed73eedeb73f4540f8edc4871945474c8 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/d377f5a28332954b19e373d36823e59830ab1712 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/0b9130247f3b6a1122478471ff0e014ea96bb735 [No types assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-41006 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-41006 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: