CVE-2024-56643

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-56643
In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccp_feat_change_recv If dccp_feat_push_confirm() fails after new value for SP feature was accepted without reconciliation ('entry == NULL' branch), memory allocated for that value with dccp_feat_clone_sp_val() is never freed. Here is the kmemleak stack for this: unreferenced object 0xffff88801d4ab488 (size 8): comm "syz-executor310", pid 1127, jiffies 4295085598 (age 41.666s) hex dump (first 8 bytes): 01 b4 4a 1d 80 88 ff ff ..J..... backtrace: [<00000000db7cabfe>] kmemdup+0x23/0x50 mm/util.c:128 [<0000000019b38405>] kmemdup include/linux/string.h:465 [inline] [<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:371 [inline] [<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:367 [inline] [<0000000019b38405>] dccp_feat_change_recv net/dccp/feat.c:1145 [inline] [<0000000019b38405>] dccp_feat_parse_options+0x1196/0x2180 net/dccp/feat.c:1416 [<00000000b1f6d94a>] dccp_parse_options+0xa2a/0x1260 net/dccp/options.c:125 [<0000000030d7b621>] dccp_rcv_state_process+0x197/0x13d0 net/dccp/input.c:650 [<000000001f74c72e>] dccp_v4_do_rcv+0xf9/0x1a0 net/dccp/ipv4.c:688 [<00000000a6c24128>] sk_backlog_rcv include/net/sock.h:1041 [inline] [<00000000a6c24128>] __release_sock+0x139/0x3b0 net/core/sock.c:2570 [<00000000cf1f3a53>] release_sock+0x54/0x1b0 net/core/sock.c:3111 [<000000008422fa23>] inet_wait_for_connect net/ipv4/af_inet.c:603 [inline] [<000000008422fa23>] __inet_stream_connect+0x5d0/0xf70 net/ipv4/af_inet.c:696 [<0000000015b6f64d>] inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:735 [<0000000010122488>] __sys_connect_file+0x15c/0x1a0 net/socket.c:1865 [<00000000b4b70023>] __sys_connect+0x165/0x1a0 net/socket.c:1882 [<00000000f4cb3815>] __do_sys_connect net/socket.c:1892 [inline] [<00000000f4cb3815>] __se_sys_connect net/socket.c:1889 [inline] [<00000000f4cb3815>] __x64_sys_connect+0x6e/0xb0 net/socket.c:1889 [<00000000e7b1e839>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 [<0000000055e91434>] entry_SYSCALL_64_after_hwframe+0x67/0xd1 Clean up the allocated memory in case of dccp_feat_push_confirm() failure and bail out with an error reset code. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/22be4727a8f898442066bcac34f8a1ad0bc72e14 Patch
https://git.kernel.org/stable/c/623be080ab3c13d71570bd32f7202a8efa8e2252 Patch
https://git.kernel.org/stable/c/6ff67909ee2ffad911e3122616df41dee23ff4f6 Patch
https://git.kernel.org/stable/c/9ee68b0f23706a77f53c832457b9384178b76421 Patch
https://git.kernel.org/stable/c/bc3d4423def1a9412a0ae454cb4477089ab79276 Patch
https://git.kernel.org/stable/c/c99507fff94b926fc92279c92d80f229c91cb85d Patch
https://git.kernel.org/stable/c/d3ec686a369fae5034303061f003cd3f94ddfd23 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
History

06 Jan 2025, 17:14

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dccp: Se corrige la pérdida de memoria en dccp_feat_change_recv Si dccp_feat_push_confirm() falla después de que se aceptó un nuevo valor para la característica SP sin conciliación (rama 'entry == NULL'), la memoria asignada para ese valor con dccp_feat_clone_sp_val() nunca se libera. Aquí está la pila kmemleak para esto: objeto sin referencia 0xffff88801d4ab488 (tamaño 8): comm "syz-executor310", pid 1127, jiffies 4295085598 (edad 41.666s) volcado hexadecimal (primeros 8 bytes): 01 b4 4a 1d 80 88 ff ff ..J..... backtrace: [&lt;00000000db7cabfe&gt;] kmemdup+0x23/0x50 mm/util.c:128 [&lt;0000000019b38405&gt;] kmemdup include/linux/string.h:465 [en línea] [&lt;0000000019b38405&gt;] dccp_feat_clone_sp_val net/dccp/feat.c:371 [en línea] [&lt;0000000019b38405&gt;] dccp_feat_clone_sp_val net/dccp/feat.c:367 [en línea] [&lt;0000000019b38405&gt;] dccp_feat_change_recv net/dccp/feat.c:1145 [en línea] [&lt;0000000019b38405&gt;] dccp_feat_parse_options+0x1196/0x2180 net/dccp/feat.c:1416 [&lt;00000000b1f6d94a&gt;] dccp_parse_options+0xa2a/0x1260 net/dccp/options.c:125 [&lt;0000000030d7b621&gt;] dccp_rcv_state_process+0x197/0x13d0 red/dccp/input.c:650 [&lt;000000001f74c72e&gt;] dccp_v4_do_rcv+0xf9/0x1a0 red/dccp/ipv4.c:688 [&lt;00000000a6c24128&gt;] sk_backlog_rcv incluir/net/sock.h:1041 [en línea] [&lt;00000000a6c24128&gt;] __release_sock+0x139/0x3b0 red/core/sock.c:2570 [&lt;00000000cf1f3a53&gt;] release_sock+0x54/0x1b0 net/core/sock.c:3111 [&lt;000000008422fa23&gt;] espera_de_conexión inet net/ipv4/af_inet.c:603 [en línea] [&lt;000000008422fa23&gt;] __inet_stream_connect+0x5d0/0xf70 net/ipv4/af_inet.c:696 [&lt;0000000015b6f64d&gt;] inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:735 [&lt;0000000010122488&gt;] archivo_de_conexión_sys+0x15c/0x1a0 net/socket.c:1865 [&lt;00000000b4b70023&gt;] __sys_connect+0x165/0x1a0 red/socket.c:1882 [&lt;00000000f4cb3815&gt;] __do_sys_connect red/socket.c:1892 [en línea] [&lt;00000000f4cb3815&gt;] __se_sys_connect red/socket.c:1889 [en línea] [&lt;00000000f4cb3815&gt;] __x64_sys_connect+0x6e/0xb0 red/socket.c:1889 [&lt;00000000e7b1e839&gt;] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 [&lt;0000000055e91434&gt;] entry_SYSCALL_64_after_hwframe+0x67/0xd1 Limpia la memoria asignada en caso de que dccp_feat_push_confirm() falle y se resuelve con un código de reinicio de error. Encontrado por Linux Verification Center (linuxtesting.org) con Syzkaller.
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401
References () https://git.kernel.org/stable/c/22be4727a8f898442066bcac34f8a1ad0bc72e14 - () https://git.kernel.org/stable/c/22be4727a8f898442066bcac34f8a1ad0bc72e14 - Patch
References () https://git.kernel.org/stable/c/623be080ab3c13d71570bd32f7202a8efa8e2252 - () https://git.kernel.org/stable/c/623be080ab3c13d71570bd32f7202a8efa8e2252 - Patch
References () https://git.kernel.org/stable/c/6ff67909ee2ffad911e3122616df41dee23ff4f6 - () https://git.kernel.org/stable/c/6ff67909ee2ffad911e3122616df41dee23ff4f6 - Patch
References () https://git.kernel.org/stable/c/9ee68b0f23706a77f53c832457b9384178b76421 - () https://git.kernel.org/stable/c/9ee68b0f23706a77f53c832457b9384178b76421 - Patch
References () https://git.kernel.org/stable/c/bc3d4423def1a9412a0ae454cb4477089ab79276 - () https://git.kernel.org/stable/c/bc3d4423def1a9412a0ae454cb4477089ab79276 - Patch
References () https://git.kernel.org/stable/c/c99507fff94b926fc92279c92d80f229c91cb85d - () https://git.kernel.org/stable/c/c99507fff94b926fc92279c92d80f229c91cb85d - Patch
References () https://git.kernel.org/stable/c/d3ec686a369fae5034303061f003cd3f94ddfd23 - () https://git.kernel.org/stable/c/d3ec686a369fae5034303061f003cd3f94ddfd23 - Patch

27 Dec 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-27 15:15

Updated : 2025-04-17 21:15

NVD link : CVE-2024-56643

Mitre link : CVE-2024-56643

CVE.ORG link : CVE-2024-56643

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime