CVE-2024-56644

{"id": "CVE-2024-56644", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2024-12-27T15:15:24.163", "references": [{"url": "https://git.kernel.org/stable/c/0b8903e6c881f72c6849d4952de742c656eb5ab9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3301ab7d5aeb0fe270f73a3d4810c9d1b6a9f045", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/535add1e9f274502209cb997801208bbe1ae6c6f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8b591bd522b71c42a82898290e35d32b482047e4", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a95808252e8acc0123bacd2dff8b9af10bc145b7", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b90d061345bb8cd51fece561a800bae1c95448a6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f43d12fd0fa8ee5b9caf8a3927e10d06431764d2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: release expired exception dst cached in socket\n\nDst objects get leaked in ip6_negative_advice() when this function is\nexecuted for an expired IPv6 route located in the exception table. There\nare several conditions that must be fulfilled for the leak to occur:\n* an ICMPv6 packet indicating a change of the MTU for the path is received,\n resulting in an exception dst being created\n* a TCP connection that uses the exception dst for routing packets must\n start timing out so that TCP begins retransmissions\n* after the exception dst expires, the FIB6 garbage collector must not run\n before TCP executes ip6_negative_advice() for the expired exception dst\n\nWhen TCP executes ip6_negative_advice() for an exception dst that has\nexpired and if no other socket holds a reference to the exception dst, the\nrefcount of the exception dst is 2, which corresponds to the increment\nmade by dst_init() and the increment made by the TCP socket for which the\nconnection is timing out. The refcount made by the socket is never\nreleased. The refcount of the dst is decremented in sk_dst_reset() but\nthat decrement is counteracted by a dst_hold() intentionally placed just\nbefore the sk_dst_reset() in ip6_negative_advice(). After\nip6_negative_advice() has finished, there is no other object tied to the\ndst. The socket lost its reference stored in sk_dst_cache and the dst is\nno longer in the exception table. The exception dst becomes a leaked\nobject.\n\nAs a result of this dst leak, an unbalanced refcount is reported for the\nloopback device of a net namespace being destroyed under kernels that do\nnot contain e5f80fcf869a (\"ipv6: give an IPv6 dev to blackhole_netdev\"):\nunregister_netdevice: waiting for lo to become free. Usage count = 2\n\nFix the dst leak by removing the dst_hold() in ip6_negative_advice(). The\npatch that introduced the dst_hold() in ip6_negative_advice() was\n92f1655aa2b22 (\"net: fix __dst_negative_advice() race\"). But 92f1655aa2b22\nmerely refactored the code with regards to the dst refcount so the issue\nwas present even before 92f1655aa2b22. The bug was introduced in\n54c1a859efd9f (\"ipv6: Don't drop cache route entry unless timer actually\nexpired.\") where the expired cached route is deleted and the sk_dst_cache\nmember of the socket is set to NULL by calling dst_negative_advice() but\nthe refcount belonging to the socket is left unbalanced.\n\nThe IPv4 version - ipv4_negative_advice() - is not affected by this bug.\nWhen the TCP connection times out ipv4_negative_advice() merely resets the\nsk_dst_cache of the socket while decrementing the refcount of the\nexception dst."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/ipv6: liberaci\u00f3n de la excepci\u00f3n dst expirada almacenada en cach\u00e9 en el socket. Los objetos Dst se filtran en ip6_negative_advice() cuando se ejecuta esta funci\u00f3n para una ruta IPv6 expirada ubicada en la tabla de excepciones. Hay varias condiciones que deben cumplirse para que se produzca la fuga: * se recibe un paquete ICMPv6 que indica un cambio de la MTU para la ruta, lo que da como resultado la creaci\u00f3n de un dst de excepci\u00f3n * una conexi\u00f3n TCP que utiliza el dst de excepci\u00f3n para enrutar paquetes debe comenzar a agotar el tiempo de espera para que TCP comience las retransmisiones * despu\u00e9s de que el dst de excepci\u00f3n caduque, el recolector de basura FIB6 no debe ejecutarse antes de que TCP ejecute ip6_negative_advice() para el dst de excepci\u00f3n caducado Cuando TCP ejecuta ip6_negative_advice() para un dst de excepci\u00f3n que ha caducado y si ning\u00fan otro socket tiene una referencia al dst de excepci\u00f3n, el recuento de referencias del dst de excepci\u00f3n es 2, que corresponde al incremento realizado por dst_init() y el incremento realizado por el socket TCP para el que se agota el tiempo de espera de la conexi\u00f3n. El recuento de referencias realizado por el socket nunca se libera. El recuento de referencias del dst se reduce en sk_dst_reset() pero esa reducci\u00f3n se contrarresta con un dst_hold() colocado intencionalmente justo antes del sk_dst_reset() en ip6_negative_advice(). Despu\u00e9s de que ip6_negative_advice() haya terminado, no hay otro objeto vinculado al dst. El socket perdi\u00f3 su referencia almacenada en sk_dst_cache y el dst ya no est\u00e1 en la tabla de excepciones. El dst de excepci\u00f3n se convierte en un objeto filtrado. Como resultado de esta filtraci\u00f3n de dst, se informa un recuento de referencias desequilibrado para el dispositivo de bucle invertido de un espacio de nombres de red que se destruye en n\u00facleos que no contienen e5f80fcf869a (\"ipv6: dar un dev IPv6 a blackhole_netdev\"): unregister_netdevice: esperando a que lo se libere. Recuento de uso = 2 Corrija la filtraci\u00f3n de dst eliminando dst_hold() en ip6_negative_advice(). El parche que introdujo dst_hold() en ip6_negative_advice() fue 92f1655aa2b22 (\"net: fix __dst_negative_advice() race\"). Pero 92f1655aa2b22 simplemente refactoriz\u00f3 el c\u00f3digo con respecto al recuento de referencias dst, por lo que el problema estaba presente incluso antes de 92f1655aa2b22. El error se introdujo en 54c1a859efd9f (\"ipv6: Don't drop cache route entry sometimes expired.\") donde la ruta en cach\u00e9 expirada se elimina y el miembro sk_dst_cache del socket se establece en NULL al llamar a dst_negative_advice(), pero el recuento de referencias que pertenece al socket se deja desequilibrado. La versi\u00f3n IPv4 - ipv4_negative_advice() - no se ve afectada por este error. Cuando se agota el tiempo de conexi\u00f3n TCP, ipv4_negative_advice() simplemente restablece el sk_dst_cache del socket mientras disminuye el recuento de referencias del dst de excepci\u00f3n."}], "lastModified": "2025-09-26T16:49:02.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3874AF00-E1A5-4124-80DF-030377E17814", "versionEndExcluding": "3.0", "versionStartIncluding": "2.6.33"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5016AD75-DDF6-4339-9948-CB535EB9E518", "versionEndExcluding": "5.4.287", "versionStartIncluding": "2.6.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935", "versionEndExcluding": "5.10.231", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89", "versionEndExcluding": "5.15.174", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09AC6122-E2A4-40FE-9D33-268A1B2EC265", "versionEndExcluding": "6.1.120", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29A976AD-B9AB-4A95-9F08-7669F8847EB9", "versionEndExcluding": "6.6.66", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9501D045-7A94-42CA-8B03-821BE94A65B7", "versionEndExcluding": "6.12.5", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3B1BC1D-ED46-4364-A1D9-1FA74182B03A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7927713B-5EB0-41EB-86A9-9935775162E0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "59037296-3143-4FBB-AFF7-D4FE2C85502F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9CA27FD5-7DBF-4C85-80A9-D523B2E4B033"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9711E333-A8E7-4F4B-BCFD-2023E889651A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E04D3358-973B-42A1-8E08-2E3AE947193C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62567B3C-6CEE-46D0-BC2E-B3717FBF7D13"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}