CVE-2024-36009: ax25: Fix netdev refcount issue
ax25: Fix netdev refcount issue
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.35.1-1 - Configuration
When the ax25 device is detaching, deallocate the dev_tracker of ax25_cb in ax25_kill_by_device() instead of deallocating the dev_tracker of ax25_dev.
ax25 dev_tracker deallocation target during device detach = ax25_cb (instead of ax25_dev) - Configuration
In ax25_bind(), set/associate ax25_dev's dev_tracker to the dev_tracker of ax25_cb (i.e., 'Change ax25_dev->dev_tracker to the dev_tracker of ax25_cb').
ax25 dev_tracker association during bind = dev_tracker from ax25_cb
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36009?
CVE-2024-36009 is considered a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-36009?
To fix CVE-2024-36009, upgrade to the patched kernel versions 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.16-1.
What systems are affected by CVE-2024-36009?
CVE-2024-36009 affects certain versions of the Linux kernel, particularly versions prior to 5.10.234-1.
What component is identified in CVE-2024-36009?
CVE-2024-36009 identifies a netdev refcount issue in the ax25 component of the Linux kernel.
What does CVE-2024-36009 impact?
CVE-2024-36009 impacts the stability and reliability of network device operations in the Linux kernel.