cbcvebase.
CVE-2024-50186
published 2024-11-08

CVE-2024-50186: In the Linux kernel, the following vulnerability has been resolved: net: explicitly clear the sk pointer, when pf->create fails We have recently noticed the…

PriorityP336high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.23%
14.3th percentile
In the Linux kernel, the following vulnerability has been resolved: net: explicitly clear the sk pointer, when pf->create fails We have recently noticed the exact same KASAN splat as in commit 6cd4a78d962b ("net: do not leave a dangling sk pointer, when socket creation fails"). The problem is that commit did not fully address the problem, as some pf->create implementations do not use sk_common_release in their error paths. For example, we can use the same reproducer as in the above commit, but changing ping to arping. arping uses AF_PACKET socket and if packet_create fails, it will just sk_free the allocated sk object. While we could chase all the pf->create implementations and make sure they NULL the freed sk object on error from the socket, we can't guarantee future protocols will not make the same mistake. So it is easier to just explicitly NULL the sk pointer upon return from pf->create in __sock_create. We do know that pf->create always releases the allocated sk object on error, so if the pointer is not NULL, it is definitely dangling.

Affected

29 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.115-1 (bookworm)linux 6.1.115-1 (bookworm)
debianlinux-6.1< linux 6.1.115-1 (bookworm)linux 6.1.115-1 (bookworm)
linuxlinux
linuxlinux
linuxlinux>= 454c454ed645fed051216b79622f7cb69c1638f5 < 563e6892e21d6ecabdf62103fc4e7b326d212334563e6892e21d6ecabdf62103fc4e7b326d212334
linuxlinux>= 5.15.162 < 5.15.1685.15.168
linuxlinux>= 6.1.96 < 6.1.1136.1.113
linuxlinux>= 6.6.36 < 6.6.576.6.57
linuxlinux>= 6.9.7 < 6.106.10
linuxlinux>= 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 < 8e1b72fd74bf9da3b099d09857f4e7f114f38e128e1b72fd74bf9da3b099d09857f4e7f114f38e12
linuxlinux>= 6cd4a78d962bebbaf8beb7d2ead3f34120e3f7b2 < 631083143315d1b192bd7d915b967b37819e88ea631083143315d1b192bd7d915b967b37819e88ea
linuxlinux>= 78e4aa528a7b1204219d808310524344f627d069 < daf462ff3cde6ecf22b98d9ae770232c10d28de2daf462ff3cde6ecf22b98d9ae770232c10d28de2
linuxlinux>= 893eeba94c40d513cd0fe6539330ebdaea208c0e < b7d22a79ff4e962b8af5ffe623abd1d6c179eb9fb7d22a79ff4e962b8af5ffe623abd1d6c179eb9f
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.1.115-16.1.115-1
linuxlinux_kernel>= 0 < 6.11.4-16.11.4-1
linuxlinux_kernel>= 0 < 6.11.4-16.11.4-1
linuxlinux_kernel>= 0 < 5.15.0-127.1375.15.0-127.137
linuxlinux_kernel>= 0 < 6.8.0-56.586.8.0-56.58
linuxlinux_kernel>= 0 < 6.11.0-18.186.11.0-18.18
linuxlinux_kernel>= 5.15.162 < 5.15.1685.15.168
linuxlinux_kernel>= 6.1.96 < 6.1.1136.1.113
linuxlinux_kernel>= 6.10 < 6.11.46.11.4
linuxlinux_kernel>= 6.6.36 < 6.6.576.6.57
linuxlinux_kernel>= 6.9.7 < 6.106.10

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_ubuntu8.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.