Homepage

Memory Leak Affecting kernel-uek-debug-devel package, versions <0:5.15.0-210.163.7.el8uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.04% (6th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE8-KERNELUEKDEBUGDEVEL-7942129
  • published13 Sept 2024
  • disclosed12 Jul 2024
Report a new vulnerability Found a mistake?

Introduced: 12 Jul 2024

CVE-2024-41006  (opens in a new tab)
CWE-401  (opens in a new tab)

How to fix?

Upgrade Oracle:8 kernel-uek-debug-devel to version 0:5.15.0-210.163.7.el8uek or higher.
This issue was patched in ELSA-2024-12618.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-debug-devel package and not the kernel-uek-debug-devel package as distributed by Oracle. See How to fix? for Oracle:8 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

netrom: Fix a memory leak in nr_heartbeat_expiry()

syzbot reported a memory leak in nr_create() 0.

Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.") added sock_hold() to the nr_heartbeat_expiry() function, where a) a socket has a SOCK_DESTROY flag or b) a listening socket has a SOCK_DEAD flag.

But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor has already been closed and the nr_release() function has been called. So it makes no sense to hold the reference count because no one will call another nr_destroy_socket() and put it as in the case "b."

nr_connect nr_establish_data_link nr_start_heartbeat

nr_release switch (nr->state) case NR_STATE_3 nr->state = NR_STATE_2 sock_set_flag(sk, SOCK_DESTROY);

                    nr_rx_frame
                      nr_process_rx_frame
                        switch (nr-&gt;state)
                        case NR_STATE_2
                          nr_state2_machine()
                            nr_disconnect()
                              nr_sk(sk)-&gt;state = NR_STATE_0
                              sock_set_flag(sk, SOCK_DEAD)


                nr_heartbeat_expiry
                  switch (nr-&amp;gt;state)
                  case NR_STATE_0
                    if (sock_flag(sk, SOCK_DESTROY) ||
                       (sk-&amp;gt;sk_state == TCP_LISTEN
                         &amp;amp;&amp;amp; sock_flag(sk, SOCK_DEAD)))
                       sock_hold()  // ( !!! )
                       nr_destroy_socket()

To fix the memory leak, let's call sock_hold() only for a listening socket.

Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller.

References

CVSS Scores

version 3.1