CVE-2024-26865: linux-libc-dev - Fix use-after-free vulnerability in reqsk_timer_handler()
Summary
CVE-2024-26865: In the Linux kernel, the following vulnerability has been resolved: rds: tcp: Fix use-after-free of net in reqsk_timer_handler(). Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
linux-libc-dev is a package that provides the Linux kernel headers for use by glibc and other C library implementations. It contains the necessary header files and static libraries for compiling C programs that use system calls and other kernel interfaces. This package is an essential component for building and running applications on Linux systems.
Vulnerability Detail
The vulnerability identified as CVE-2024-26865 in linux-libc-dev is a use-after-free vulnerability in the reqsk_timer_handler() function of the RDS (Reliable Datagram Sockets) TCP implementation. This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges. The vulnerability arises from a race condition where a reqsk (request socket) is freed while its timer is still active, leading to a use-after-free scenario. This can be triggered when a network namespace is dismantled while a reqsk timer is active.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at this time. It is recommended to apply the official fix by updating the linux-libc-dev package.
Conclusion
The use-after-free vulnerability in the reqsk_timer_handler() function of linux-libc-dev can lead to a denial-of-service condition or potential code execution. It is crucial to update the linux-libc-dev package to version 6.1.90-1 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the Linux kernel headers for use by glibc and other C library implementations. It is essential for compiling C programs that use system calls and other kernel interfaces.
This vulnerability can be exploited by an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with elevated privileges.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later.
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating the linux-libc-dev package.
More information about this vulnerability can be found in the CVE-2024-26865 entry on the National Vulnerability Database (NVD) website.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
