PT-2024-2015 · Linux+5 · Linux Kernel+5
Syzbot
·
Published
2024-01-30
·
Updated
2025-02-03
·
CVE-2024-26625
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.8.0
Description
The vulnerability exists due to insufficient input validation in the sock orphan() function of the Linux kernel. Exploitation of the vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information. The issue is caused by a stale sk->sk wq pointer in a closed llc socket.
Recommendations
To resolve the issue, update the Linux kernel to version 6.8.0 or later. If updating is not possible, consider temporarily disabling the sock orphan() function until a patch is available. However, this is not recommended as it may cause other issues.
Note: The provided information does not specify the exact versions affected, but it mentions that the issue is resolved in version 6.8.0. Therefore, it is assumed that all versions prior to 6.8.0 are affected.
Exploit
Fix
Use After Free
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu