PT-2024-35613 · Linux+6 · Linux Kernel+6
Liu Jian
·
Published
2024-11-28
·
Updated
2026-05-26
·
CVE-2024-53168
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.12.0-rc4-dirty
Description
A use-after-free issue has been identified in the Linux kernel's sunrpc module, specifically related to the kernel's TCP socket handling. This issue arises when the TCP socket in a network namespace is shut down and closed, but the FIN message with acknowledgement is discarded, leading to the nfsd side continuing to send retransmission messages. As a result, when the TCP socket processes the received message, it sends the FIN message in the sending queue, and the TCP timer is re-established, causing problems when the network namespace is deleted.
Recommendations
To resolve this issue, hold the netns refcnt for the TCP kernel socket as done in other modules. This can be backported to earlier kernels. A proper fix that cleans up the interfaces will follow, but may not be easy to backport.
For versions prior to 6.12.0-rc4-dirty, consider applying the provided fix or waiting for an official patch.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu