CVE-2024-35887: ax25: fix use-after-free bugs caused by ax25_ds_del_timer
ax25: fix use-after-free bugs caused by ax25dsdeltimer
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1Fixed in 6.12.27-1 - Configuration
Ensure /etc/modprobe.d/blacklist-rare-network.conf contains: alias net-pf-3 off.
Linux modprobe (modprobe.d blacklist) alias net-pf-3 = off - Compensating control
When the ax25 device is detaching, use timer_shutdown_sync() to stop the timer to mitigate the ax25 use-after-free bug caused by ax25_ds_del_timer/del_timer.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35887?
CVE-2024-35887 is categorized with a moderate severity level due to potential use-after-free vulnerabilities.
How do I fix CVE-2024-35887?
To mitigate CVE-2024-35887, update to the latest versions of the Linux kernel, specifically 6.12.11-1 or 6.12.12-1.
Which versions of the Linux kernel are affected by CVE-2024-35887?
CVE-2024-35887 affects Linux kernel versions from 2.6.12 to 6.6.26 and includes versions 6.7 and 6.9-rc1 and 6.9-rc2.
What is a use-after-free vulnerability in the context of CVE-2024-35887?
In CVE-2024-35887, a use-after-free vulnerability allows access to freed memory, potentially leading to system instability or exploitation.
Is there a specific distribution affected by CVE-2024-35887?
Yes, Debian Linux distributions are affected and have provided specific package versions to resolve the vulnerability.