CVE-2024-41006

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netrom: Fix a memory leak in nr_heartbeat_expiry()<br /> <br /> syzbot reported a memory leak in nr_create() [0].<br /> <br /> Commit 409db27e3a2e ("netrom: Fix use-after-free of a listening socket.")<br /> added sock_hold() to the nr_heartbeat_expiry() function, where<br /> a) a socket has a SOCK_DESTROY flag or<br /> b) a listening socket has a SOCK_DEAD flag.<br /> <br /> But in the case "a," when the SOCK_DESTROY flag is set, the file descriptor<br /> has already been closed and the nr_release() function has been called.<br /> So it makes no sense to hold the reference count because no one will<br /> call another nr_destroy_socket() and put it as in the case "b."<br /> <br /> nr_connect<br /> nr_establish_data_link<br /> nr_start_heartbeat<br /> <br /> nr_release<br /> switch (nr-&gt;state)<br /> case NR_STATE_3<br /> nr-&gt;state = NR_STATE_2<br /> sock_set_flag(sk, SOCK_DESTROY);<br /> <br /> nr_rx_frame<br /> nr_process_rx_frame<br /> switch (nr-&gt;state)<br /> case NR_STATE_2<br /> nr_state2_machine()<br /> nr_disconnect()<br /> nr_sk(sk)-&gt;state = NR_STATE_0<br /> sock_set_flag(sk, SOCK_DEAD)<br /> <br /> nr_heartbeat_expiry<br /> switch (nr-&gt;state)<br /> case NR_STATE_0<br /> if (sock_flag(sk, SOCK_DESTROY) ||<br /> (sk-&gt;sk_state == TCP_LISTEN<br /> &amp;&amp; sock_flag(sk, SOCK_DEAD)))<br /> sock_hold() // ( !!! )<br /> nr_destroy_socket()<br /> <br /> To fix the memory leak, let&amp;#39;s call sock_hold() only for a listening socket.<br /> <br /> Found by InfoTeCS on behalf of Linux Verification Center<br /> (linuxtesting.org) with Syzkaller.<br /> <br /> [0]: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16