CVE-2024-49940: l2tp: prevent possible tunnel refcount underflow
In the Linux kernel, the following vulnerability has been resolved:
l2tp: prevent possible tunnel refcount underflow
When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tpsessionfree drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tpsessioncreate, before the tunnel refcount is incremented by l2tpsessionregister, which leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped.
Moving the assignment to l2tpsessionregister is trivial but l2tpsessioncreate calls l2tpsessionsetheaderlen which uses session->tunnel to get the tunnel's encap. Add an encap arg to l2tpsessionsetheaderlen to avoid using session->tunnel.
If l2tpv3 sessions have colliding IDs, it is possible for l2tpv3sessionget to race with l2tpsessionregister and fetch a session which doesn't yet have session->tunnel set. Add a check for this case.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49940?
CVE-2024-49940 is categorized as a medium-severity vulnerability in the Linux kernel.
How do I fix CVE-2024-49940?
To fix CVE-2024-49940, users should update their Linux kernel to versions 6.12.12-1 or 6.12.15-1, or to applicable Debian package versions.
What systems are affected by CVE-2024-49940?
CVE-2024-49940 affects various versions of the Linux kernel prior to 6.12.12-1 and specific Debian packages.
What type of vulnerability is CVE-2024-49940?
CVE-2024-49940 is a reference counting issue that can potentially lead to a tunnel refcount underflow.
Can CVE-2024-49940 be exploited remotely?
While CVE-2024-49940 primarily affects local sessions, an attacker with session control may exploit it, making proper security measures essential.