7.8

CVE-2024-53206

tcp: Fix use-after-free of nreq in reqsk_timer_handler().

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix use-after-free of nreq in reqsk_timer_handler().

The cited commit replaced inet_csk_reqsk_queue_drop_and_put() with
__inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handler().

Then, oreq should be passed to reqsk_put() instead of req; otherwise
use-after-free of nreq could happen when reqsk is migrated but the
retry attempt failed (e.g. due to timeout).

Let's pass oreq to reqsk_put().
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.15.170 < 5.15.174
Linux ≫ Linux Kernel Version >= 6.1.115 < 6.1.120
Linux ≫ Linux Kernel Version >= 6.6.59 < 6.6.64
Linux ≫ Linux Kernel Version >= 6.11.6 < 6.11.11
Linux ≫ Linux Kernel Version >= 6.12 < 6.12.2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.132
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/2dcc86fefe09ac853158afd96b60d544af115dc5
Patch
https://git.kernel.org/stable/c/65ed89cad1f57034c256b016e89e8c0a4ec7c65b
Patch
https://git.kernel.org/stable/c/6d845028609a4af0ad66f499ee0bd5789122b067
Patch
https://git.kernel.org/stable/c/9a3c1ad93e6fba67b3a637cfa95a57a6685e4908
Patch
https://git.kernel.org/stable/c/c31e72d021db2714df03df6c42855a1db592716c
Patch
https://git.kernel.org/stable/c/d0eb14cb8c08b00c36a3d5dc57a6f428b301f721
Patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html