IM
IronMonkey Threat Research

CVE-2024-49944 MEDIUM

Published: 2024-10-21 | Last Modified: 2026-05-12 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason. Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline]

Additional Descriptions (1)

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: sctp: volver a establecer sk_state en CERRADO si fallo la vinculación automática en sctp_listen_start En sctp_listen_start() invocado por sctp_inet_listen(), debería volver a establecer sk_state en CERRADO si sctp_autobind() falla por cualquier motivo. De lo contrario, la próxima vez que se llame a sctp_inet_listen(), si sctp_sk(sk)-&gt;reuse ya está establecido mediante setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)-&gt;bind_hash se desreferenciará ya que sk_state está ESCUCHANDO, lo que provoca un bloqueo ya que bind_hash es NULL. KASAN: null-ptr-deref en el rango [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Seguimiento de llamadas: __sys_listen_socket net/socket.c:1883 [en línea] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [en línea]

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en NVD-CWE-noinfo

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd340129780> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd34012adc0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd341240c40> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd340a8d480> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3401285c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd340129400> Operating System
linux linux_kernel 6.12 <built-in method update of dict object at 0x7fd349343040> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*

References