In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix use-after-free of nreq in reqsktimerhandler().
The cited commit replaced inetcskreqskqueuedropandput() with _inetcskreqskqueuedrop() and reqskput() in reqsktimerhandler().
Then, oreq should be passed to reqsk_put() instead of req; otherwise use-after-free of nreq could happen when reqsk is migrated but the retry attempt failed (e.g. due to timeout).
Let's pass oreq to reqsk_put().
[
{
"id": "CVE-2024-53206-22dfa0fd",
"deprecated": false,
"target": {
"file": "net/ipv4/inet_connection_sock.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"58329849550488851647099436974632714393",
"103800306609408761253401848741401333593",
"157760205801111598276693228098366491713",
"148942925838291868767467529871236903217"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6d845028609a4af0ad66f499ee0bd5789122b067",
"signature_type": "Line"
},
{
"id": "CVE-2024-53206-5268ad8f",
"deprecated": false,
"target": {
"file": "net/ipv4/inet_connection_sock.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"58329849550488851647099436974632714393",
"103800306609408761253401848741401333593",
"157760205801111598276693228098366491713",
"148942925838291868767467529871236903217"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65ed89cad1f57034c256b016e89e8c0a4ec7c65b",
"signature_type": "Line"
},
{
"id": "CVE-2024-53206-7f9e73fb",
"deprecated": false,
"target": {
"file": "net/ipv4/inet_connection_sock.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"58329849550488851647099436974632714393",
"103800306609408761253401848741401333593",
"157760205801111598276693228098366491713",
"148942925838291868767467529871236903217"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c31e72d021db2714df03df6c42855a1db592716c",
"signature_type": "Line"
},
{
"id": "CVE-2024-53206-ac3933f9",
"deprecated": false,
"target": {
"file": "net/ipv4/inet_connection_sock.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"58329849550488851647099436974632714393",
"103800306609408761253401848741401333593",
"157760205801111598276693228098366491713",
"148942925838291868767467529871236903217"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9a3c1ad93e6fba67b3a637cfa95a57a6685e4908",
"signature_type": "Line"
},
{
"id": "CVE-2024-53206-b5110130",
"deprecated": false,
"target": {
"file": "net/ipv4/inet_connection_sock.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"58329849550488851647099436974632714393",
"103800306609408761253401848741401333593",
"157760205801111598276693228098366491713",
"148942925838291868767467529871236903217"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2dcc86fefe09ac853158afd96b60d544af115dc5",
"signature_type": "Line"
},
{
"id": "CVE-2024-53206-cf34e014",
"deprecated": false,
"target": {
"file": "net/ipv4/inet_connection_sock.c"
},
"signature_version": "v1",
"digest": {
"line_hashes": [
"58329849550488851647099436974632714393",
"103800306609408761253401848741401333593",
"157760205801111598276693228098366491713",
"148942925838291868767467529871236903217"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0eb14cb8c08b00c36a3d5dc57a6f428b301f721",
"signature_type": "Line"
}
]