PT-2024-6978 · Linux+10 · Linux Kernel+10
Ignat Korchagin
+1
·
Published
2024-06-20
·
Updated
2026-05-26
·
CVE-2024-40954
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.10.0-rc2+
Description
The vulnerability is related to a use-after-free issue in the Linux kernel's networking code. It can be triggered by attaching an fentry probe to
sock release() and the probe calling the bpf get socket cookie() helper, or by running traceroute -I 1.1.1.1 on a freshly booted VM. A KASAN enabled kernel will log a slab-use-after-free error in sock gen cookie(). The issue is caused by a dangling sk pointer when socket creation fails.To exploit this vulnerability, an attacker would need to be able to run privileged commands on the system, such as attaching an fentry probe or running
traceroute with specific options. The vulnerability could potentially allow an attacker to gain elevated privileges or disrupt system operation.Recommendations
To resolve this issue, it is recommended to update the Linux kernel to a version that includes the fix for this vulnerability. Specifically, the fix involves clearing the struct socket reference in
sk common release() to cover all protocol families create functions.At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu