CVE-2024-26625

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk to NULL after calling proto_ops::release()") Eric Biggers hinted that some protocols are missing a sock_orphan(), we need to perform a full audit. In net-next, I plan to clear sock->sk from sock_orphan() and amend Eric patch to add a warning. [1] BUG: KASAN: slab-use-after-free in list_empty include/linux/list.h:373 [inline] BUG: KASAN...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= 43815482370c510c569fd18edb57afcb0fa8cab6 < 6b950c712a9a05cdda4aea7fcb2848766576c11b, >= 43815482370c510c569fd18edb57afcb0fa8cab6 < 64babb17e8150771c58575d8f93a35c5296b499f, >= 43815482370c510c569fd18edb57afcb0fa8cab6 < d0b5b1f12429df3cd9751ab8b2f53729b77733b7, >= 43815482370c510c569fd18edb57afcb0fa8cab6 < dbc1b89981f9c5360277071d33d7f04a43ffda4a, >= 43815482370c510c569fd18edb57afcb0fa8cab6 < 9c333d9891f34cea8af1b229dc754552304c8eee, >= 43815482370c510c569fd18edb57afcb0fa8cab6 < 3151051b787f7cd7e3329ea0016eb9113c248812, >= 43815482370c510c569fd18edb57afcb0fa8cab6 < 8e51f084b5716653f19e291ed5f026791d4b3ed4, >= 43815482370c510c569fd18edb57afcb0fa8cab6 < aa2b2eb3934859904c287bf5434647ba72e14c1c, >= 2.6.35, >= 2.6.35 < 4.19.307, >= 4.20 < 5.4.269, >= 5.5 < 5.10.210, >= 5.11 < 5.15.149, >= 5.16 < 6.1.77, >= 6.2 < 6.6.16, >= 6.7 < 6.7.4, 6.8, 10.0

Fixed versions

4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16, 6.7.4

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416