CVE-2024-56643: dccp: Fix memory leak in dccp_feat_change_recv
In the Linux kernel, the following vulnerability has been resolved:
dccp: Fix memory leak in dccpfeatchangerecv
If dccpfeatpushconfirm() fails after new value for SP feature was accepted without reconciliation ('entry == NULL' branch), memory allocated for that value with dccpfeatclonespval() is never freed.
Here is the kmemleak stack for this:
unreferenced object 0xffff88801d4ab488 (size 8): comm "syz-executor310", pid 1127, jiffies 4295085598 (age 41.666s) hex dump (first 8 bytes): 01 b4 4a 1d 80 88 ff ff ..J..... backtrace: [<00000000db7cabfe>] kmemdup+0x23/0x50 mm/util.c:128 [<0000000019b38405>] kmemdup include/linux/string.h:465 [inline] [<0000000019b38405>] dccpfeatclonespval net/dccp/feat.c:371 [inline] [<0000000019b38405>] dccpfeatclonespval net/dccp/feat.c:367 [inline] [<0000000019b38405>] dccpfeatchangerecv net/dccp/feat.c:1145 [inline] [<0000000019b38405>] dccpfeatparseoptions+0x1196/0x2180 net/dccp/feat.c:1416 [<00000000b1f6d94a>] dccpparseoptions+0xa2a/0x1260 net/dccp/options.c:125 [<0000000030d7b621>] dccprcvstateprocess+0x197/0x13d0 net/dccp/input.c:650 [<000000001f74c72e>] dccpv4dorcv+0xf9/0x1a0 net/dccp/ipv4.c:688 [<00000000a6c24128>] skbacklogrcv include/net/sock.h:1041 [inline] [<00000000a6c24128>] releasesock+0x139/0x3b0 net/core/sock.c:2570 [<00000000cf1f3a53>] releasesock+0x54/0x1b0 net/core/sock.c:3111 [<000000008422fa23>] inetwaitforconnect net/ipv4/afinet.c:603 [inline] [<000000008422fa23>] inetstreamconnect+0x5d0/0xf70 net/ipv4/afinet.c:696 [<0000000015b6f64d>] inetstreamconnect+0x53/0xa0 net/ipv4/afinet.c:735 [<0000000010122488>] sysconnectfile+0x15c/0x1a0 net/socket.c:1865 [<00000000b4b70023>] sysconnect+0x165/0x1a0 net/socket.c:1882 [<00000000f4cb3815>] dosysconnect net/socket.c:1892 [inline] [<00000000f4cb3815>] sesysconnect net/socket.c:1889 [inline] [<00000000f4cb3815>] x64sysconnect+0x6e/0xb0 net/socket.c:1889 [<00000000e7b1e839>] dosyscall64+0x33/0x40 arch/x86/entry/common.c:46 [<0000000055e91434>] entrySYSCALL64afterhwframe+0x67/0xd1
Clean up the allocated memory in case of dccpfeatpushconfirm() failure and bail out with an error reset code.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56643?
The severity of CVE-2024-56643 is not specified in the public advisory, but it addresses a memory leak in the Linux kernel.
How do I fix CVE-2024-56643?
To fix CVE-2024-56643, you should update to the latest version of the Linux kernel that includes the patch.
What systems are affected by CVE-2024-56643?
CVE-2024-56643 affects multiple versions of the Linux kernel ranging from 2.6.29 to 6.13-rc1.
What does CVE-2024-56643 involve?
CVE-2024-56643 involves a memory leak in the dccp_feat_change_recv function of the Linux kernel.
Is there a public disclosure for CVE-2024-56643?
Yes, CVE-2024-56643 has been documented and publicly disclosed by the Linux kernel development team.