In the Linux kernel, the following vulnerability has been resolved:
netrom: Decrease sock refcount when sock timers expire
Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use sock timer API. It replaces mod_timer() by sk_reset_timer(), and del_timer() by sk_stop_timer().
Function sk_reset_timer() will increase the refcount of sock if it is called on an inactive timer, hence, in case the timer expires, we need to decrease the refcount ourselves in the handler, otherwise, the sock refcount will be unbalanced and the sock will never be freed.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-azureUpgrade kernel-default-develUpgrade kernel-syms-azureUpgrade kernel-develUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade kernel-obs-buildUpgrade kernel-source-azureUpgrade kernel-azure-baseUpgrade kernel-azure-develUpgrade kernel-defaultUpgrade kernel-docsUpgrade kernel-symsUpgrade kernel-default-baseUpgrade kernel-default-manUpgrade kernel-default-extraUpgrade kernel-macros | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-1150-kvmUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-virtualUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-4.4.0-1187-awsUpgrade linux-image-fipsUpgrade linux-image-4.4.0-274-genericUpgrade linux-image-4.4.0-1149-awsUpgrade linux-image-genericUpgrade linux-image-awsUpgrade linux-image-4.4.0-1119-fipsUpgrade linux-image-4.4.0-274-lowlatency | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub