PT-2024-7283 · Linux+3 · Linux Kernel+3
Published
2024-02-16
·
Updated
2025-03-27
·
CVE-2024-26741
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to the fixed version
Description:
The vulnerability is related to the dccp/tcp component of the Linux kernel. When an unbound socket is used to call connect(), the kernel searches for an available ephemeral port and checks if the corresponding bucket is reusable by calling inet check established() or inet6 check established(). If the bucket is reusable, the socket is added to the ehash and the inet sk(sk)->inet num is set. However, if the allocation of the bucket fails, the changes must be reverted to prevent an unconnected socket from occupying an ehash entry. The vulnerability occurs when the kernel fails to properly revert these changes, potentially leading to a denial-of-service condition.
Recommendations:
To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. The exact version is not specified in the provided information, so it is recommended to update to the latest available version. Additionally, consider implementing measures to prevent exploitation, such as restricting access to the vulnerable component or disabling the
connect() function until a patch is available.Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse