netrom: Fix a memory leak in nr_heartbeat_expiry()
In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nr_heartbeat_expiry() syzbot reported a memory leak in nr_create() [0]. Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.") added sock_hold() to the nr_heartbeat_expiry() function, where a) a socket has a SOCK_DESTROY flag or b) a listening socket has a SOCK_DEAD flag. But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor has already been closed and the nr_release() function has been called. So it makes no sense to hold the reference count because no one will call another nr_destroy_socket() and put it as in the case "b." nr_connect nr_establish_data_link nr_start_heartbeat nr_release switch (nr->state) case NR_STATE_3 nr->state = NR_STATE_2 sock_set_flag(sk, SOCK_DESTROY); nr_rx_frame nr_process_rx_frame switch (nr->state) case NR_STATE_2 nr_state2_machine() nr_disconnect() nr_sk(sk)->state = NR_STATE_0 sock_set_flag(sk, SOCK_DEAD) nr_heartbeat_expiry switch (nr->state) case NR_STATE_0 if (sock_flag(sk, SOCK_DESTROY) || (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) sock_hold() // ( !!! ) nr_destroy_socket() To fix the memory leak, let's call sock_hold() only for a listening socket. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller. [0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16
CVE-2024-41006
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2024-41006
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a31caf5779ace8fa98b0d454133808e082ee7a1b",
"lessThan": "d616876256b38ecf9a1a1c7d674192c5346bc69c",
"versionType": "git"
},
{
"status": "affected",
"version": "fe9b9e621cebe6b7e83f7e954c70f8bb430520e5",
"lessThan": "e07a9c2a850cdebf625e7a1b8171bd23a8554313",
"versionType": "git"
},
{
"status": "affected",
"version": "7de16d75b20ab13b75a7291f449a1b00090edfea",
"lessThan": "5391f9db2cab5ef1cb411be1ab7dbec728078fba",
"versionType": "git"
},
{
"status": "affected",
"version": "d2d3ab1b1de3302de2c85769121fd4f890e47ceb",
"lessThan": "280cf1173726a7059b628c610c71050d5c0b6937",
"versionType": "git"
},
{
"status": "affected",
"version": "51e394c6f81adbfe7c34d15f58b3d4d44f144acf",
"lessThan": "a02fd5d775cf9787ee7698c797e20f2fa13d2e2b",
"versionType": "git"
},
{
"status": "affected",
"version": "409db27e3a2eb5e8ef7226ca33be33361b3ed1c9",
"lessThan": "b6ebe4fed73eedeb73f4540f8edc4871945474c8",
"versionType": "git"
},
{
"status": "affected",
"version": "409db27e3a2eb5e8ef7226ca33be33361b3ed1c9",
"lessThan": "d377f5a28332954b19e373d36823e59830ab1712",
"versionType": "git"
},
{
"status": "affected",
"version": "409db27e3a2eb5e8ef7226ca33be33361b3ed1c9",
"lessThan": "0b9130247f3b6a1122478471ff0e014ea96bb735",
"versionType": "git"
},
{
"status": "affected",
"version": "e666990abb2e42dd4ba979b4706280a3664cfae7",
"versionType": "git"
},
{
"status": "affected",
"version": "4.19.272",
"lessThan": "4.19.317",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.231",
"lessThan": "5.4.279",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.166",
"lessThan": "5.10.221",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.91",
"lessThan": "5.15.162",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.1.9",
"lessThan": "6.1.96",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.14.305",
"lessThan": "4.15",
"versionType": "semver"
}
],
"programFiles": [
"net/netrom/nr_timer.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.317",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.279",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.221",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.162",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.96",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.36",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.9.7",
"versionType": "semver",
"lessThanOrEqual": "6.9.*"
},
{
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/netrom/nr_timer.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2024-41006
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #26657 · Revision 1
- Added to Heist Feed
- Publisher date