PT-2024-36914 · Linux+7 · Linux Kernel+7
Eric Dumazet
+1
·
Published
2024-10-15
·
Updated
2026-02-12
·
CVE-2024-56606
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
A vulnerability in the Linux kernel has been resolved, specifically in the af packet module. The issue occurs after the sock init data() function is called in packet create(), where the allocated sk object is attached to the provided sock object. If an error occurs, packet create() frees the sk object, leaving a dangling pointer in the sock object. This can cause use-after-free errors if other code attempts to use the pointer.
Recommendations
For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue.
As a temporary workaround, consider restricting access to the af packet module until a patch is available.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu