CVE-2024-49944: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
In the Linux kernel, the following vulnerability has been resolved:
sctp: set skstate back to CLOSED if autobind fails in sctplistenstart
In sctplistenstart() invoked by sctpinetlisten(), it should set the skstate back to CLOSED if sctpautobind() fails due to whatever reason.
Otherwise, next time when calling sctpinetlisten(), if sctpsk(sk)->reuse is already set via setsockopt(SCTPREUSEPORT), sctpsk(sk)->bindhash will be dereferenced as skstate is LISTENING, which causes a crash as bindhash is NULL.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctpinetlisten+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> syslistensocket net/socket.c:1883 [inline] syslisten+0x1b7/0x230 net/socket.c:1894 dosyslisten net/socket.c:1902 [inline]
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-49944?
CVE-2024-49944 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-49944?
To fix CVE-2024-49944, upgrade to the latest patched version of the Linux kernel as specified in the security advisory.
Which versions of the Linux kernel are affected by CVE-2024-49944?
CVE-2024-49944 affects multiple versions of the Linux kernel, specifically versions from 2.6.30 up to 6.11.3, and some release candidates.
What impact does CVE-2024-49944 have on system security?
CVE-2024-49944 can potentially lead to unexpected behavior in the state management of SCTP sockets, affecting network communication.
Is there a specific patch for CVE-2024-49944?
Yes, the patch for CVE-2024-49944 is included in the newer releases of the Linux kernel that address the vulnerability.