CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create()
In the Linux kernel, the following vulnerability has been resolved:
net: inet: do not leave a dangling sk pointer in inetcreate()
sockinitdata() attaches the allocated sk object to the provided sock object. If inetcreate() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create use-after-free later.
Clear the sk pointer in the sock object on error.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56601?
CVE-2024-56601 has a moderate severity level due to potential risk of system instability.
Which versions of the Linux kernel are affected by CVE-2024-56601?
CVE-2024-56601 affects Linux kernel versions up to 5.4.287 and specific ranges from 5.5 up to 6.6.66.
How do I fix CVE-2024-56601?
To fix CVE-2024-56601, update the Linux kernel to the latest stable version that eliminates this vulnerability.
What systems are impacted by CVE-2024-56601?
Systems running affected versions of the Linux kernel may experience issues related to socket handling.
Is CVE-2024-56601 a remote or local vulnerability?
CVE-2024-56601 can be exploited locally, requiring access to the system to trigger the issue.