Critical Vulnerability in Linux Package: Dangling Pointer in Socket Creation
Summary
DEBIAN-CVE-2024-50293: In the Linux kernel, the following vulnerability has been resolved: net/smc: do not leave a dangling sk pointer in smc_create() Thanks to commit 4bbd360a5084 ("socket: Print pf->create() when it does not clear sock->sk o... Affects linux versions < 6.11.9-1. Fixed in 6.11.9-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux package is a core component of the Debian operating system, providing essential functionalities for managing hardware and system resources. It serves as the foundation for running applications and services on Linux-based systems. This package is crucial for network operations, including socket management, which is vital for communication between processes. The vulnerability in question affects the socket creation process, potentially leading to system instability and security risks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the socket management code, specifically in the AF_SMC (Socket Management Control) implementation. The issue arises when the function __smc_create() fails to clear the socket's sk pointer, resulting in a dangling pointer. This can lead to undefined behavior, crashes, or exploitation by malicious actors. The vulnerability was discovered thanks to syzbot and is documented in commit 4bbd360a5084. The affected versions are prior to 6.11.9-1, and the issue has been officially recognized as DEBIAN-CVE-2024-50293.
How To Fix
Minimum fixed version
6.11.9-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any potential risks.
Conclusion
The identified vulnerability in the Linux package poses significant risks to system stability and security. It is essential for users to update to the patched version 6.11.9-1 or later to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a dangling pointer in the socket creation process, which can lead to system instability and potential exploitation.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Failure to address this vulnerability may result in system crashes, instability, and increased risk of exploitation by attackers.
Yes, the vulnerability is fixed in version 6.11.9-1 and later. It is crucial to update to this version to ensure system security.
Yes, Vulert allows you to monitor vulnerabilities using just a manifest file like package-lock.json, without requiring installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
