CVE-2024-56644

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/ipv6: release expired exception dst cached in socket

Dst objects get leaked in ip6_negative_advice() when this function is

executed for an expired IPv6 route located in the exception table. There

are several conditions that must be fulfilled for the leak to occur:

* an ICMPv6 packet indicating a change of the MTU for the path is received,

resulting in an exception dst being created

* a TCP connection that uses the exception dst for routing packets must

start timing out so that TCP begins retransmissions

* after the exception dst expires, the FIB6 garbage collector must not run

before TCP executes ip6_negative_advice() for the expired exception dst

When TCP executes ip6_negative_advice() for an exception dst that has

expired and if no other socket holds a reference to the exception dst, the

refcount of the exception dst is 2, which corresponds to the increment

made by dst_init() and the increment made by th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References