Linux Kernel up to 6.12.4 dccp_feat_push_confirm memory leak

Summaryinfo

A vulnerability marked as critical has been reported in Linux Kernel up to 6.12.4. The affected element is the function dccp_feat_push_confirm. The manipulation leads to memory leak. This vulnerability is traded as CVE-2024-56643. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.12.4. This issue affects the function dccp_feat_push_confirm. The manipulation with an unknown input leads to a memory leak vulnerability. Using CWE to declare the problem leads to CWE-401. The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccp_feat_change_recv If dccp_feat_push_confirm() fails after new value for SP feature was accepted without reconciliation ('entry == NULL' branch), memory allocated for that value with dccp_feat_clone_sp_val() is never freed. Here is the kmemleak stack for this: unreferenced object 0xffff88801d4ab488 (size 8): comm "syz-executor310", pid 1127, jiffies 4295085598 (age 41.666s) hex dump (first 8 bytes): 01 b4 4a 1d 80 88 ff ff ..J..... backtrace: [] kmemdup+0x23/0x50 mm/util.c:128 [] kmemdup include/linux/string.h:465 [inline] [] dccp_feat_clone_sp_val net/dccp/feat.c:371 [inline] [] dccp_feat_clone_sp_val net/dccp/feat.c:367 [inline] [] dccp_feat_change_recv net/dccp/feat.c:1145 [inline] [] dccp_feat_parse_options+0x1196/0x2180 net/dccp/feat.c:1416 [] dccp_parse_options+0xa2a/0x1260 net/dccp/options.c:125 [] dccp_rcv_state_process+0x197/0x13d0 net/dccp/input.c:650 [] dccp_v4_do_rcv+0xf9/0x1a0 net/dccp/ipv4.c:688 [] sk_backlog_rcv include/net/sock.h:1041 [inline] [] __release_sock+0x139/0x3b0 net/core/sock.c:2570 [] release_sock+0x54/0x1b0 net/core/sock.c:3111 [] inet_wait_for_connect net/ipv4/af_inet.c:603 [inline] [] __inet_stream_connect+0x5d0/0xf70 net/ipv4/af_inet.c:696 [] inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:735 [] __sys_connect_file+0x15c/0x1a0 net/socket.c:1865 [] __sys_connect+0x165/0x1a0 net/socket.c:1882 [] __do_sys_connect net/socket.c:1892 [inline] [] __se_sys_connect net/socket.c:1889 [inline] [] __x64_sys_connect+0x6e/0xb0 net/socket.c:1889 [] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 [] entry_SYSCALL_64_after_hwframe+0x67/0xd1 Clean up the allocated memory in case of dccp_feat_push_confirm() failure and bail out with an error reset code. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2024-56643 since 12/27/2024. The exploitation is known to be difficult. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 214901 (SUSE SLES15 Security Update : kernel (SUSE-SU-2025:0289-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.4.287, 5.10.231, 5.15.174, 6.1.120, 6.6.66 or 6.12.5 eliminates this vulnerability. Applying the patch 623be080ab3c13d71570bd32f7202a8efa8e2252/c99507fff94b926fc92279c92d80f229c91cb85d/bc3d4423def1a9412a0ae454cb4477089ab79276/6ff67909ee2ffad911e3122616df41dee23ff4f6/d3ec686a369fae5034303061f003cd3f94ddfd23/9ee68b0f23706a77f53c832457b9384178b76421/22be4727a8f898442066bcac34f8a1ad0bc72e14 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (214901) and CERT Bund (WID-SEC-2024-3762). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• Dell NetWorker
• Dell Avamar
• Red Hat OpenShift
• IBM QRadar SIEM
• Dell PowerProtect Data Domain
• Open Source Linux Kernel
• IBM DataPower Gateway
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.4.286
• 5.10.230
• 5.15.173
• 6.1.119
• 6.6.0
• 6.6.1
• 6.6.2
• 6.6.3
• 6.6.4
• 6.6.5
• 6.6.6
• 6.6.7
• 6.6.8
• 6.6.9
• 6.6.10
• 6.6.11
• 6.6.12
• 6.6.13
• 6.6.14
• 6.6.15
• 6.6.16
• 6.6.17
• 6.6.18
• 6.6.19
• 6.6.20
• 6.6.21
• 6.6.22
• 6.6.23
• 6.6.24
• 6.6.25
• 6.6.26
• 6.6.27
• 6.6.28
• 6.6.29
• 6.6.30
• 6.6.31
• 6.6.32
• 6.6.33
• 6.6.34
• 6.6.35
• 6.6.36
• 6.6.37
• 6.6.38
• 6.6.39
• 6.6.40
• 6.6.41
• 6.6.42
• 6.6.43
• 6.6.44
• 6.6.45
• 6.6.46
• 6.6.47
• 6.6.48
• 6.6.49
• 6.6.50
• 6.6.51
• 6.6.52
• 6.6.53
• 6.6.54
• 6.6.55
• 6.6.56
• 6.6.57
• 6.6.58
• 6.6.59
• 6.6.60
• 6.6.61
• 6.6.62
• 6.6.63
• 6.6.64
• 6.6.65
• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion