In the Linux kernel, the following vulnerability has been resolved:
netrom: Decrease sock refcount when sock timers expire
Commit 63346650c1a9 ("netrom: switch to sock timer API") switched to use sock timer API. It replaces mod_timer() by sk_reset_timer(), and del_timer() by sk_stop_timer().
Function sk_reset_timer() will increase the refcount of sock if it is called on an inactive timer, hence, in case the timer expires, we need to decrease the refcount ourselves in the handler, otherwise, the sock refcount will be unbalanced and the sock will never be freed.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 21, 2024 |
| Suse | — | Upgrade kernel-azure-baseUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade kernel-default-extraUpgrade kernel-default-manUpgrade kernel-azure-develUpgrade kernel-docsUpgrade kernel-symsUpgrade kernel-macrosUpgrade kernel-syms-azureUpgrade kernel-default-develUpgrade kernel-azureUpgrade kernel-develUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-obs-buildUpgrade kernel-devel-azure | Aug 9, 2024 | May 21, 2024 |
| Ubuntu | — | Upgrade linux-image-4.4.0-274-genericUpgrade linux-image-4.4.0-274-lowlatencyUpgrade linux-image-4.4.0-1187-awsUpgrade linux-image-fipsUpgrade linux-image-genericUpgrade linux-image-4.4.0-1149-awsUpgrade linux-image-awsUpgrade linux-image-4.4.0-1119-fipsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-lowlatencyUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.4.0-1150-kvmUpgrade linux-image-virtualUpgrade linux-image-kvm | Nov 19, 2024 | May 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub