CVE-2024-56643

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

dccp: Fix memory leak in dccp_feat_change_recv

If dccp_feat_push_confirm() fails after new value for SP feature was accepted

without reconciliation ('entry == NULL' branch), memory allocated for that value

with dccp_feat_clone_sp_val() is never freed.

Here is the kmemleak stack for this:

unreferenced object 0xffff88801d4ab488 (size 8):

comm "syz-executor310", pid 1127, jiffies 4295085598 (age 41.666s)

hex dump (first 8 bytes):

01 b4 4a 1d 80 88 ff ff ..J.....

backtrace:

[<00000000db7cabfe>] kmemdup+0x23/0x50 mm/util.c:128

[<0000000019b38405>] kmemdup include/linux/string.h:465 [inline]

[<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:371 [inline]

[<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:367 [inline]

[<0000000019b38405>] dccp_feat_change_recv net/dccp/feat.c:1145 [inline]

[<0000000019b38405>] dccp_feat_parse_options+0x1196/0x218

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References