PT-2024-36909 · Linux+8 · Linux Kernel+8
Ignat Korchagin
·
Published
2024-10-15
·
Updated
2025-11-18
·
CVE-2024-56601
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
A vulnerability in the Linux kernel has been resolved, where the
inet create() function could leave a dangling sk pointer. The sock init data() function attaches the allocated sk object to the provided sock object. If inet create() fails later, the sk object is freed, but the sock object retains the dangling pointer, which may create a use-after-free issue later. The fix involves clearing the sk pointer in the sock object on error.Recommendations
For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider implementing custom error handling to clear the
sk pointer in the sock object when inet create() fails.Exploit
Fix
Use After Free
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu