CVE-2024-36904

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's sk_refcnt after putting it into ehash and releasing the bucket lock. Thus, there is a small race window where other threads could try to reuse the port during connect() and call sock_hold() in tcp_twsk_unique() for the TIME-WAIT socket with zer...

Affected product and versions

Product

Linux Linux, RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Affected versions

>= ec94c2696f0bcd5ae92a553244e4ac30d2171a2d < 84546cc1aeeb4df3e444b18a4293c9823f974be9, >= ec94c2696f0bcd5ae92a553244e4ac30d2171a2d < 1796ca9c6f5bd50554214053af5f47d112818ee3, >= ec94c2696f0bcd5ae92a553244e4ac30d2171a2d < 1d9cf07810c30ef7948879567d10fd1f01121d34, >= ec94c2696f0bcd5ae92a553244e4ac30d2171a2d < 27b0284d8be182a81feb65581ab6a724dfd596e8, >= ec94c2696f0bcd5ae92a553244e4ac30d2171a2d < 13ed7cdf079686ccd3618335205700c03f6fb446, >= ec94c2696f0bcd5ae92a553244e4ac30d2171a2d < 6e48faad92be13166184d21506e4e54c79c13adc, >= ec94c2696f0bcd5ae92a553244e4ac30d2171a2d < 517e32ea0a8c72202d0d8aa8df50a7cd3d6fdefc, >= ec94c2696f0bcd5ae92a553244e4ac30d2171a2d < f2db7230f73a80dbb179deab78f88a7947f0ab7e, >= 4.16, < V3.1, >= V3.1.0 < V3.1.5, >= 4.16 < 4.19.314, >= 4.20 < 5.4.276, >= 5.5 < 5.10.217, >= 5.11 < 5.15.159, >= 5.16 < 6.1.91, >= 6.2 < 6.6.31, >= 6.7 < 6.8.10, 6.9, 10.0

Fixed versions

4.19.314, 5.4.276, 5.10.217, 5.15.159, 6.1.91, 6.6.31, 6.8.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416