CVE-2024-57841 (GCVE-0-2024-57841)
Vulnerability from cvelistv5
Published
2025-01-15 13:10
Modified
2025-05-04 13:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: fix memory leak in tcp_conn_request()
If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will
return without free the dst memory, which allocated in af_ops->route_req.
Here is the kmemleak stack:
unreferenced object 0xffff8881198631c0 (size 240):
comm "softirq", pid 0, jiffies 4299266571 (age 1802.392s)
hex dump (first 32 bytes):
00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................
81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U..............
backtrace:
[<ffffffffb93e8d4c>] kmem_cache_alloc+0x60c/0xa80
[<ffffffffba11b4c5>] dst_alloc+0x55/0x250
[<ffffffffba227bf6>] rt_dst_alloc+0x46/0x1d0
[<ffffffffba23050a>] __mkroute_output+0x29a/0xa50
[<ffffffffba23456b>] ip_route_output_key_hash+0x10b/0x240
[<ffffffffba2346bd>] ip_route_output_flow+0x1d/0x90
[<ffffffffba254855>] inet_csk_route_req+0x2c5/0x500
[<ffffffffba26b331>] tcp_conn_request+0x691/0x12c0
[<ffffffffba27bd08>] tcp_rcv_state_process+0x3c8/0x11b0
[<ffffffffba2965c6>] tcp_v4_do_rcv+0x156/0x3b0
[<ffffffffba299c98>] tcp_v4_rcv+0x1cf8/0x1d80
[<ffffffffba239656>] ip_protocol_deliver_rcu+0xf6/0x360
[<ffffffffba2399a6>] ip_local_deliver_finish+0xe6/0x1e0
[<ffffffffba239b8e>] ip_local_deliver+0xee/0x360
[<ffffffffba239ead>] ip_rcv+0xad/0x2f0
[<ffffffffba110943>] __netif_receive_skb_one_core+0x123/0x140
Call dst_release() to free the dst memory when
inet_csk_reqsk_queue_hash_add() return false in tcp_conn_request().
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ► | Linux | Linux |
Version: 527bec1f56ac7a2fceb8eb77eb0fc2678ecba394 Version: c14f3c3793f7a785763e353df7fc40426187f832 Version: fdae4d139f4778b20a40c60705c53f5f146459b5 Version: ff46e3b4421923937b7f6e44ffcd3549a074f321 Version: ff46e3b4421923937b7f6e44ffcd3549a074f321 Version: 360892e60710427229fc1f7bb2218cf4d578229b |
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9d38959677291552d1b0ed2689a540af279b5bf8",
"status": "affected",
"version": "527bec1f56ac7a2fceb8eb77eb0fc2678ecba394",
"versionType": "git"
},
{
"lessThan": "de3f999bf8aee16e9da1c1224191abdc69e97c9d",
"status": "affected",
"version": "c14f3c3793f7a785763e353df7fc40426187f832",
"versionType": "git"
},
{
"lessThan": "2af69905180b3fea12f9c1db374b153a06977021",
"status": "affected",
"version": "fdae4d139f4778b20a40c60705c53f5f146459b5",
"versionType": "git"
},
{
"lessThan": "b0b190218c78d8aeecfba36ea3a90063b3ede52d",
"status": "affected",
"version": "ff46e3b4421923937b7f6e44ffcd3549a074f321",
"versionType": "git"
},
{
"lessThan": "4f4aa4aa28142d53f8b06585c478476cfe325cfc",
"status": "affected",
"version": "ff46e3b4421923937b7f6e44ffcd3549a074f321",
"versionType": "git"
},
{
"status": "affected",
"version": "360892e60710427229fc1f7bb2218cf4d578229b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_input.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.124",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.70",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.13",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.176",
"versionStartIncluding": "5.15.162",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.124",
"versionStartIncluding": "6.1.97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.70",
"versionStartIncluding": "6.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.9",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.13",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.9.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix memory leak in tcp_conn_request()\n\nIf inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will\nreturn without free the dst memory, which allocated in af_ops-\u003eroute_req.\n\nHere is the kmemleak stack:\n\nunreferenced object 0xffff8881198631c0 (size 240):\n comm \"softirq\", pid 0, jiffies 4299266571 (age 1802.392s)\n hex dump (first 32 bytes):\n 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................\n 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U..............\n backtrace:\n [\u003cffffffffb93e8d4c\u003e] kmem_cache_alloc+0x60c/0xa80\n [\u003cffffffffba11b4c5\u003e] dst_alloc+0x55/0x250\n [\u003cffffffffba227bf6\u003e] rt_dst_alloc+0x46/0x1d0\n [\u003cffffffffba23050a\u003e] __mkroute_output+0x29a/0xa50\n [\u003cffffffffba23456b\u003e] ip_route_output_key_hash+0x10b/0x240\n [\u003cffffffffba2346bd\u003e] ip_route_output_flow+0x1d/0x90\n [\u003cffffffffba254855\u003e] inet_csk_route_req+0x2c5/0x500\n [\u003cffffffffba26b331\u003e] tcp_conn_request+0x691/0x12c0\n [\u003cffffffffba27bd08\u003e] tcp_rcv_state_process+0x3c8/0x11b0\n [\u003cffffffffba2965c6\u003e] tcp_v4_do_rcv+0x156/0x3b0\n [\u003cffffffffba299c98\u003e] tcp_v4_rcv+0x1cf8/0x1d80\n [\u003cffffffffba239656\u003e] ip_protocol_deliver_rcu+0xf6/0x360\n [\u003cffffffffba2399a6\u003e] ip_local_deliver_finish+0xe6/0x1e0\n [\u003cffffffffba239b8e\u003e] ip_local_deliver+0xee/0x360\n [\u003cffffffffba239ead\u003e] ip_rcv+0xad/0x2f0\n [\u003cffffffffba110943\u003e] __netif_receive_skb_one_core+0x123/0x140\n\nCall dst_release() to free the dst memory when\ninet_csk_reqsk_queue_hash_add() return false in tcp_conn_request()."
}
],
"providerMetadata": {
"dateUpdated": "2025-05-04T13:01:26.346Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9d38959677291552d1b0ed2689a540af279b5bf8"
},
{
"url": "https://git.kernel.org/stable/c/de3f999bf8aee16e9da1c1224191abdc69e97c9d"
},
{
"url": "https://git.kernel.org/stable/c/2af69905180b3fea12f9c1db374b153a06977021"
},
{
"url": "https://git.kernel.org/stable/c/b0b190218c78d8aeecfba36ea3a90063b3ede52d"
},
{
"url": "https://git.kernel.org/stable/c/4f4aa4aa28142d53f8b06585c478476cfe325cfc"
}
],
"title": "net: fix memory leak in tcp_conn_request()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2024-57841",
"datePublished": "2025-01-15T13:10:26.842Z",
"dateReserved": "2025-01-15T13:08:59.716Z",
"dateUpdated": "2025-05-04T13:01:26.346Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-57841\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-15T13:15:12.130\",\"lastModified\":\"2025-01-21T17:38:48.263\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: fix memory leak in tcp_conn_request()\\n\\nIf inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will\\nreturn without free the dst memory, which allocated in af_ops-\u003eroute_req.\\n\\nHere is the kmemleak stack:\\n\\nunreferenced object 0xffff8881198631c0 (size 240):\\n comm \\\"softirq\\\", pid 0, jiffies 4299266571 (age 1802.392s)\\n hex dump (first 32 bytes):\\n 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ................\\n 81 55 18 bb ff ff ff ff 00 00 00 00 00 00 00 00 .U..............\\n backtrace:\\n [\u003cffffffffb93e8d4c\u003e] kmem_cache_alloc+0x60c/0xa80\\n [\u003cffffffffba11b4c5\u003e] dst_alloc+0x55/0x250\\n [\u003cffffffffba227bf6\u003e] rt_dst_alloc+0x46/0x1d0\\n [\u003cffffffffba23050a\u003e] __mkroute_output+0x29a/0xa50\\n [\u003cffffffffba23456b\u003e] ip_route_output_key_hash+0x10b/0x240\\n [\u003cffffffffba2346bd\u003e] ip_route_output_flow+0x1d/0x90\\n [\u003cffffffffba254855\u003e] inet_csk_route_req+0x2c5/0x500\\n [\u003cffffffffba26b331\u003e] tcp_conn_request+0x691/0x12c0\\n [\u003cffffffffba27bd08\u003e] tcp_rcv_state_process+0x3c8/0x11b0\\n [\u003cffffffffba2965c6\u003e] tcp_v4_do_rcv+0x156/0x3b0\\n [\u003cffffffffba299c98\u003e] tcp_v4_rcv+0x1cf8/0x1d80\\n [\u003cffffffffba239656\u003e] ip_protocol_deliver_rcu+0xf6/0x360\\n [\u003cffffffffba2399a6\u003e] ip_local_deliver_finish+0xe6/0x1e0\\n [\u003cffffffffba239b8e\u003e] ip_local_deliver+0xee/0x360\\n [\u003cffffffffba239ead\u003e] ip_rcv+0xad/0x2f0\\n [\u003cffffffffba110943\u003e] __netif_receive_skb_one_core+0x123/0x140\\n\\nCall dst_release() to free the dst memory when\\ninet_csk_reqsk_queue_hash_add() return false in tcp_conn_request().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: se corrige p\u00e9rdida de memoria en tcp_conn_request() Si inet_csk_reqsk_queue_hash_add() devuelve falso, tcp_conn_request() devolver\u00e1 sin liberar la memoria dst, que se asign\u00f3 en af_ops-\u0026gt;route_req. Aqu\u00ed est\u00e1 la pila de kmemleak: objeto sin referencia 0xffff8881198631c0 (tama\u00f1o 240): comm \\\"softirq\\\", pid 0, jiffies 4299266571 (edad 1802.392s) volcado hexadecimal (primeros 32 bytes): 00 10 9b 03 81 88 ff ff 80 98 da bc ff ff ff ff ff ................ 81 55 18 bb ff ff ff ff ff 00 00 00 00 00 00 00 00 .U.............. backtrace: [] kmem_cache_alloc+0x60c/0xa80 [] dst_alloc+0x55/0x250 [] rt_dst_alloc+0x46/0x1d0 [] __mkroute_output+0x29a/0xa50 [] ip_route_output_key_hash+0x10b/0x240 [] ip_route_output_flow+0x1d/0x90 [] inet_csk_route_req+0x2c5/0x500 [] tcp_conn_request+0x691/0x12c0 [] tcp_rcv_state_process+0x3c8/0x11b0 [] tcp_v4_do_rcv+0x156/0x3b0 [] tcp_v4_rcv+0x1cf8/0x1d80 [] ip_protocol_deliver_rcu+0xf6/0x360 [] ip_local_deliver_finish+0xe6/0x1e0 [] ip_local_deliver+0xee/0x360 [] ip_rcv+0xad/0x2f0 [] __netif_receive_skb_one_core+0x123/0x140 Llame a dst_release() para liberar la memoria dst cuando inet_csk_reqsk_queue_hash_add() devuelva falso en tcp_conn_request().\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.162\",\"versionEndExcluding\":\"5.15.176\",\"matchCriteriaId\":\"88DBFD98-7785-4A6A-AA7F-8C2715361050\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.97\",\"versionEndExcluding\":\"6.1.124\",\"matchCriteriaId\":\"7305E5A6-B62F-45D3-AA4A-0E2F640E6E09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.37\",\"versionEndExcluding\":\"6.6.70\",\"matchCriteriaId\":\"79218475-6B07-4205-9FAA-0AFB7784D237\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9.8\",\"versionEndExcluding\":\"6.12.9\",\"matchCriteriaId\":\"F0A6EA8F-92C6-43F5-808B-8C50A4D7AB9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2af69905180b3fea12f9c1db374b153a06977021\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4f4aa4aa28142d53f8b06585c478476cfe325cfc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d38959677291552d1b0ed2689a540af279b5bf8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b0b190218c78d8aeecfba36ea3a90063b3ede52d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/de3f999bf8aee16e9da1c1224191abdc69e97c9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…