CVE-2024-56603: net: af_can: do not leave a dangling sk pointer in can_create()
In the Linux kernel, the following vulnerability has been resolved:
net: afcan: do not leave a dangling sk pointer in cancreate()
On error cancreate() frees the allocated sk object, but sockinitdata() has already attached it to the provided sock object. This will leave a dangling sk pointer in the sock object and may cause use-after-free later.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56603?
CVE-2024-56603 is classified with a moderate severity due to the potential for a dangling pointer which can lead to system instability.
How do I fix CVE-2024-56603?
To fix CVE-2024-56603, update your Linux kernel to a version that is beyond the affected ranges described in the vulnerability.
Which Linux kernel versions are affected by CVE-2024-56603?
CVE-2024-56603 affects Linux kernel versions ranging from 5.4 up to 6.12.5 but excludes versions above these ranges.
What is the impact of CVE-2024-56603 on system security?
The impact of CVE-2024-56603 can include potential system crashes or unpredictable behavior due to the improper management of memory pointers.
Is CVE-2024-56603 being actively exploited?
As of now, there is no confirmed information indicating that CVE-2024-56603 is actively being exploited in the wild.