CVE-2024-56661
published 2024-12-27CVE-2024-56661: In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanup_bearer() syzbot found [1] that after blamed commit…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
13.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix NULL deref in cleanup_bearer()
syzbot found [1] that after blamed commit, ub->ubsock->sk
was NULL when attempting the atomic_dec() :
atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
Fix this by caching the tipc_net pointer.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:3 Not tainted 6.13.0-rc1-next-20241203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events cleanup_bearer
RIP: 0010:read_pnet include/net/net_namespace.h:387 [inline]
RIP: 0010:sock_net include/net/sock.h:655 [inline]
RIP: 0010:cleanup_bearer+0x1f7/0x280 net/tipc/udp_media.c:820
Code: 18 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 3c f7 99 f6 48 8b 1b 48 83 c3 30 e8 f0 e4 60 00 48 89 d8 48 c1 e8 03 80 3c 28 00 74 08 48 89 df e8 1a f7 99 f6 49 83 c7 e8 48 8b 1b
RSP: 0018:ffffc9000410fb70 EFLAGS: 00010206
RAX: 0000000000000006 RBX: 0000000000000030 RCX: ffff88802fe45a00
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffc9000410f900
RBP: ffff88807e1f0908 R08: ffffc9000410f907 R09: 1ffff92000821f20
R10: dffffc0000000000 R11: fffff52000821f21 R12: ffff888031d19980
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff88807e1f0918
FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556ca050b000 CR3: 0000000031c0c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.123-1 (bookworm) | linux 6.1.123-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.123-1 (bookworm) | linux 6.1.123-1 (bookworm) |
| linux | linux | >= 4e69457f9dfae67435f3ccf29008768eae860415 < d1d4dfb189a115734bff81c411bc58d9e348db7d | d1d4dfb189a115734bff81c411bc58d9e348db7d |
| linux | linux | >= 5.10.231 < 5.10.232 | 5.10.232 |
| linux | linux | >= 5.15.174 < 5.15.175 | 5.15.175 |
| linux | linux | >= 5.4.287 < 5.4.288 | 5.4.288 |
| linux | linux | >= 6.1.120 < 6.1.121 | 6.1.121 |
| linux | linux | >= 6.12.5 < 6.12.6 | 6.12.6 |
| linux | linux | >= 6.6.66 < 6.6.67 | 6.6.67 |
| linux | linux | >= 650ee9a22d7a2de8999fac2d45983597a0c22359 < a771f349c95d3397636861a0a6462d4a7a7ecb25 | a771f349c95d3397636861a0a6462d4a7a7ecb25 |
| linux | linux | >= 6a2fa13312e51a621f652d522d7e2df7066330b6 < b04d86fff66b15c07505d226431f808c15b1703c | b04d86fff66b15c07505d226431f808c15b1703c |
| linux | linux | >= d00d4470bf8c4282617a3a10e76b20a9c7e4cffa < 89ecda492d0a37fd00aaffc4151f1f44c26d93ac | 89ecda492d0a37fd00aaffc4151f1f44c26d93ac |
| linux | linux | >= d2a4894f238551eae178904e7f45af87577074fd < 07b569eda6fe6a1e83be5a587abee12d1303f95e | 07b569eda6fe6a1e83be5a587abee12d1303f95e |
| linux | linux | >= d62d5180c036eeac09f80660edc7a602b369125f < 754ec823ee53422361da7958a8c8bf3275426912 | 754ec823ee53422361da7958a8c8bf3275426912 |
| linux | linux | >= e48b211c4c59062cb6dd6c2c37c51a7cc235a464 < a852c82eda4991e21610837aaa160965be71f5cc | a852c82eda4991e21610837aaa160965be71f5cc |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.234-1 | 5.10.234-1 |
| linux | linux_kernel | >= 0 < 6.1.123-1 | 6.1.123-1 |
| linux | linux_kernel | >= 0 < 6.12.6-1 | 6.12.6-1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens Third-Party Components in SINEC OS
cisa_ics·2025-08-14
Siemens Third-Party Components in SINEC OS
ICS Advisory
##
Siemens Third-Party Components in SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-07
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Third-Party Components in SINEC OS
- Vulnerabilities: Improper Input Validation, Use After Free, Out-of-bounds Read,
Red Hat
kernel: tipc: fix NULL deref in cleanup_bearer()
vendor_redhat·2024-12-27·CVSS 5.5
CVE-2024-56661 [MEDIUM] kernel: tipc: fix NULL deref in cleanup_bearer()
kernel: tipc: fix NULL deref in cleanup_bearer()
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix NULL deref in cleanup_bearer()
syzbot found [1] that after blamed commit, ub->ubsock->sk
was NULL when attempting the atomic_dec() :
atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
Fix this by caching the tipc_net pointer.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:3 Not tainted 6.13.0-rc1-next-20241203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events cleanup_bearer
RIP: 0010:read_pnet include/n
Debian
CVE-2024-56661: linux - In the Linux kernel, the following vulnerability has been resolved: tipc: fix N...
vendor_debian·2024·CVSS 5.5
CVE-2024-56661 [MEDIUM] CVE-2024-56661: linux - In the Linux kernel, the following vulnerability has been resolved: tipc: fix N...
In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanup_bearer() syzbot found [1] that after blamed commit, ub->ubsock->sk was NULL when attempting the atomic_dec() : atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count); Fix this by caching the tipc_net pointer. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:3 Not tainted 6.13.0-rc1-next-20241203-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events cleanup_bearer RIP: 0010:read_pnet include/net/net_namespace.h:387 [inline] RIP: 0010:sock_net
GHSA
GHSA-4g6f-5r4h-c449: In the Linux kernel, the following vulnerability has been resolved:
tipc: fix NULL deref in cleanup_bearer()
syzbot found [1] that after blamed comm
ghsa_unreviewed·2024-12-27
CVE-2024-56661 [MEDIUM] CWE-476 GHSA-4g6f-5r4h-c449: In the Linux kernel, the following vulnerability has been resolved:
tipc: fix NULL deref in cleanup_bearer()
syzbot found [1] that after blamed comm
In the Linux kernel, the following vulnerability has been resolved:
tipc: fix NULL deref in cleanup_bearer()
syzbot found [1] that after blamed commit, ub->ubsock->sk
was NULL when attempting the atomic_dec() :
atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count);
Fix this by caching the tipc_net pointer.
[1]
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037]
CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:3 Not tainted 6.13.0-rc1-next-20241203-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events cleanup_bearer
RIP: 0010:read_pnet include/net/net_namespace.h:387 [inline]
RIP: 0010:so
OSV
CVE-2024-56661: In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanup_bearer() syzbot found [1] that after blamed commit
osv·2024-12-27·CVSS 5.5
CVE-2024-56661 [MEDIUM] CVE-2024-56661: In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanup_bearer() syzbot found [1] that after blamed commit
In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in cleanup_bearer() syzbot found [1] that after blamed commit, ub->ubsock->sk was NULL when attempting the atomic_dec() : atomic_dec(&tipc_net(sock_net(ub->ubsock->sk))->wq_count); Fix this by caching the tipc_net pointer. [1] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] CPU: 0 UID: 0 PID: 5896 Comm: kworker/0:3 Not tainted 6.13.0-rc1-next-20241203-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events cleanup_bearer RIP: 0010:read_pnet include/net/net_namespace.h:387 [inline] RIP: 0010:sock_net
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/07b569eda6fe6a1e83be5a587abee12d1303f95ehttps://git.kernel.org/stable/c/754ec823ee53422361da7958a8c8bf3275426912https://git.kernel.org/stable/c/89ecda492d0a37fd00aaffc4151f1f44c26d93achttps://git.kernel.org/stable/c/a771f349c95d3397636861a0a6462d4a7a7ecb25https://git.kernel.org/stable/c/a852c82eda4991e21610837aaa160965be71f5cchttps://git.kernel.org/stable/c/b04d86fff66b15c07505d226431f808c15b1703chttps://git.kernel.org/stable/c/d1d4dfb189a115734bff81c411bc58d9e348db7dhttps://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlhttps://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
2024-12-27
Published