In the Linux kernel, the following vulnerability has been resolved: af_packet: avoid erroring out after sock_init_data() in packet_create() After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/132e615bb1d7cdec2d3cfbdec2efa630e923fd21 cve-icon cve-icon
https://git.kernel.org/stable/c/157f08db94123e2ba56877dd0ac88908b13a5dd0 cve-icon cve-icon
https://git.kernel.org/stable/c/1dc1e1db927056cb323296e2294a855cd003dfe7 cve-icon cve-icon
https://git.kernel.org/stable/c/46f2a11cb82b657fd15bab1c47821b635e03838b cve-icon cve-icon
https://git.kernel.org/stable/c/71b22837a5e55ac27d6a14b9cdf2326587405c4f cve-icon cve-icon
https://git.kernel.org/stable/c/a6cf750b737374454a4e03a5ed449a3eb0c96414 cve-icon cve-icon
https://git.kernel.org/stable/c/fd09880b16d33aa5a7420578e01cd79148fa9829 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024122704-CVE-2024-56606-bf3b@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-56606 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-56606 cve-icon
History

Tue, 11 Feb 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Jan 2025 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Weaknesses CWE-416
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 30 Dec 2024 01:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 27 Dec 2024 15:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: af_packet: avoid erroring out after sock_init_data() in packet_create() After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees the sk object leaving the dangling pointer in the sock object on return. Some other code may try to use this pointer and cause use-after-free.
Title af_packet: avoid erroring out after sock_init_data() in packet_create()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-02-11T15:45:22.662Z

Reserved: 2024-12-27T14:03:06.013Z

Link: CVE-2024-56606

cve-icon Vulnrichment

Updated: 2025-02-11T15:42:05.345Z

cve-icon NVD

Status : Modified

Published: 2024-12-27T15:15:20.087

Modified: 2025-02-11T16:15:45.563

Link: CVE-2024-56606

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-12-27T00:00:00Z

Links: CVE-2024-56606 - Bugzilla