In the Linux kernel, the following vulnerability has been resolved:
ax25: Fix reference count leak issues of ax25_dev
The ax25addrax25dev() and ax25devdevicedown() exist a reference count leak issue of the object "ax25dev".
Memory leak issue in ax25addrax25dev():
The reference count of the object "ax25dev" can be increased multiple times in ax25addr_ax25dev(). This will cause a memory leak.
Memory leak issues in ax25devdevice_down():
The reference count of ax25dev is set to 1 in ax25devdeviceup() and then increase the reference count when ax25dev is added to ax25devlist. As a result, the reference count of ax25dev is 2. But when the device is shutting down. The ax25devdevicedown() drops the reference count once or twice depending on if we goto unlockput or not, which will cause memory leak.
As for the issue of ax25addrax25dev(), it is impossible for one pointer to be on a list twice. So add a break in ax25addrax25dev(). As for the issue of ax25devdevicedown(), increase the reference count of ax25dev once in ax25devdeviceup() and decrease the reference count of ax25dev after it is removed from the ax25devlist.
{ "vanir_signatures": [ { "id": "CVE-2024-38602-0c1fbfe5", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_addr_ax25dev" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b505e0319852b08a3a716b64620168eab21f4ced", "digest": { "function_hash": "214480507298946183367308397459981867292", "length": 314.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-0d0ef618", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_down" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81d8240b0a243b3ddd8fa8aa172f1acc2f7cc8f3", "digest": { "function_hash": "245042442342477155790762185723963929686", "length": 734.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-1191ecc4", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_up" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b505e0319852b08a3a716b64620168eab21f4ced", "digest": { "function_hash": "53235099953406043322916202744327668227", "length": 1483.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-19e14dcf", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_addr_ax25dev" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ea02699c7557eeb35ccff2bd822de1b3e09d868", "digest": { "function_hash": "214480507298946183367308397459981867292", "length": 314.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-2fba7d36", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_down" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae467750a3765dd1092eb29f58247950a2f9b60c", "digest": { "function_hash": "179185879788290974140659708063999599218", "length": 710.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-3dbd9d36", "signature_type": "Line", "target": { "file": "net/ax25/ax25_dev.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ea02699c7557eeb35ccff2bd822de1b3e09d868", "digest": { "threshold": 0.9, "line_hashes": [ "204594227084865220117256514328325143894", "21182322479913780724964167733931600742", "161497298980068353903013898097732655274", "246295193471720893934291540266086687076", "107855605184989954133417953035107596968", "108083269678388999581654931426858435805", "211589378945899920678513324904263781920", "83170969532430628646574053093940972365", "274383868674875683848810007185123160876", "205943110055707292815753406597424220745", "65579017727085631949305462659514616578", "233605151902668235542174685465723580181" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-45f4702c", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_up" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38eb01edfdaa1562fa00429be2e33f45383b1b3a", "digest": { "function_hash": "53235099953406043322916202744327668227", "length": 1483.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-60a98d87", "signature_type": "Line", "target": { "file": "net/ax25/ax25_dev.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38eb01edfdaa1562fa00429be2e33f45383b1b3a", "digest": { "threshold": 0.9, "line_hashes": [ "204594227084865220117256514328325143894", "21182322479913780724964167733931600742", "161497298980068353903013898097732655274", "246295193471720893934291540266086687076", "107855605184989954133417953035107596968", "108083269678388999581654931426858435805", "211589378945899920678513324904263781920", "83170969532430628646574053093940972365", "274383868674875683848810007185123160876", "205943110055707292815753406597424220745", "65579017727085631949305462659514616578", "233605151902668235542174685465723580181" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-6df3bb36", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_up" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ea02699c7557eeb35ccff2bd822de1b3e09d868", "digest": { "function_hash": "53235099953406043322916202744327668227", "length": 1483.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-83b6dbad", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_addr_ax25dev" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae467750a3765dd1092eb29f58247950a2f9b60c", "digest": { "function_hash": "214480507298946183367308397459981867292", "length": 314.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-8c305309", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_addr_ax25dev" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81d8240b0a243b3ddd8fa8aa172f1acc2f7cc8f3", "digest": { "function_hash": "214480507298946183367308397459981867292", "length": 314.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-8df2a97c", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_down" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ea02699c7557eeb35ccff2bd822de1b3e09d868", "digest": { "function_hash": "245042442342477155790762185723963929686", "length": 734.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-9ed99405", "signature_type": "Line", "target": { "file": "net/ax25/ax25_dev.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81d8240b0a243b3ddd8fa8aa172f1acc2f7cc8f3", "digest": { "threshold": 0.9, "line_hashes": [ "204594227084865220117256514328325143894", "21182322479913780724964167733931600742", "161497298980068353903013898097732655274", "246295193471720893934291540266086687076", "107855605184989954133417953035107596968", "108083269678388999581654931426858435805", "211589378945899920678513324904263781920", "83170969532430628646574053093940972365", "274383868674875683848810007185123160876", "205943110055707292815753406597424220745", "65579017727085631949305462659514616578", "233605151902668235542174685465723580181" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-ac66b60b", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_up" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae467750a3765dd1092eb29f58247950a2f9b60c", "digest": { "function_hash": "53235099953406043322916202744327668227", "length": 1483.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-b1d5edf4", "signature_type": "Line", "target": { "file": "net/ax25/ax25_dev.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae467750a3765dd1092eb29f58247950a2f9b60c", "digest": { "threshold": 0.9, "line_hashes": [ "204594227084865220117256514328325143894", "21182322479913780724964167733931600742", "161497298980068353903013898097732655274", "246295193471720893934291540266086687076", "107855605184989954133417953035107596968", "108083269678388999581654931426858435805", "211589378945899920678513324904263781920", "83170969532430628646574053093940972365", "274383868674875683848810007185123160876", "205943110055707292815753406597424220745", "65579017727085631949305462659514616578", "233605151902668235542174685465723580181" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-b2ed23b4", "signature_type": "Line", "target": { "file": "net/ax25/ax25_dev.c" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b505e0319852b08a3a716b64620168eab21f4ced", "digest": { "threshold": 0.9, "line_hashes": [ "204594227084865220117256514328325143894", "21182322479913780724964167733931600742", "161497298980068353903013898097732655274", "246295193471720893934291540266086687076", "107855605184989954133417953035107596968", "108083269678388999581654931426858435805", "211589378945899920678513324904263781920", "83170969532430628646574053093940972365", "274383868674875683848810007185123160876", "205943110055707292815753406597424220745", "65579017727085631949305462659514616578", "233605151902668235542174685465723580181" ] }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-c94184ca", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_up" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@81d8240b0a243b3ddd8fa8aa172f1acc2f7cc8f3", "digest": { "function_hash": "53235099953406043322916202744327668227", "length": 1483.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-d60f4523", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_down" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b505e0319852b08a3a716b64620168eab21f4ced", "digest": { "function_hash": "245042442342477155790762185723963929686", "length": 734.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-d7b81e25", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_addr_ax25dev" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38eb01edfdaa1562fa00429be2e33f45383b1b3a", "digest": { "function_hash": "214480507298946183367308397459981867292", "length": 314.0 }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-38602-e430a763", "signature_type": "Function", "target": { "file": "net/ax25/ax25_dev.c", "function": "ax25_dev_device_down" }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@38eb01edfdaa1562fa00429be2e33f45383b1b3a", "digest": { "function_hash": "245042442342477155790762185723963929686", "length": 734.0 }, "deprecated": false, "signature_version": "v1" } ] }