CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create()
In the Linux kernel, the following vulnerability has been resolved:
net: inet6: do not leave a dangling sk pointer in inet6create()
sockinitdata() attaches the allocated sk pointer to the provided sock object. If inet6create() fails later, the sk object is released, but the sock object retains the dangling sk pointer, which may cause use-after-free later.
Clear the sock sk pointer on error.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56600?
CVE-2024-56600 is classified as a moderate severity vulnerability.
How do I fix CVE-2024-56600?
To fix CVE-2024-56600, update your Linux kernel to a version that includes the patch for this vulnerability.
What versions of the Linux kernel are affected by CVE-2024-56600?
CVE-2024-56600 affects Linux kernel versions up to 5.4.287 and several versions between 5.5 and 6.12.5.
What type of vulnerability is CVE-2024-56600?
CVE-2024-56600 is a memory management vulnerability related to the inet6_create() function in the Linux kernel.
What issues can CVE-2024-56600 cause?
CVE-2024-56600 can lead to potential remote code execution or denial of service due to improper socket handling.