CVE-2024-56644 (GCVE-0-2024-56644)

Vulnerability from cvelistv5 – Published: 2024-12-27 15:02 – Updated: 2026-05-23 15:55
VLAI
Title
net/ipv6: release expired exception dst cached in socket
Summary
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6_negative_advice() when this function is executed for an expired IPv6 route located in the exception table. There are several conditions that must be fulfilled for the leak to occur: * an ICMPv6 packet indicating a change of the MTU for the path is received, resulting in an exception dst being created * a TCP connection that uses the exception dst for routing packets must start timing out so that TCP begins retransmissions * after the exception dst expires, the FIB6 garbage collector must not run before TCP executes ip6_negative_advice() for the expired exception dst When TCP executes ip6_negative_advice() for an exception dst that has expired and if no other socket holds a reference to the exception dst, the refcount of the exception dst is 2, which corresponds to the increment made by dst_init() and the increment made by the TCP socket for which the connection is timing out. The refcount made by the socket is never released. The refcount of the dst is decremented in sk_dst_reset() but that decrement is counteracted by a dst_hold() intentionally placed just before the sk_dst_reset() in ip6_negative_advice(). After ip6_negative_advice() has finished, there is no other object tied to the dst. The socket lost its reference stored in sk_dst_cache and the dst is no longer in the exception table. The exception dst becomes a leaked object. As a result of this dst leak, an unbalanced refcount is reported for the loopback device of a net namespace being destroyed under kernels that do not contain e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev"): unregister_netdevice: waiting for lo to become free. Usage count = 2 Fix the dst leak by removing the dst_hold() in ip6_negative_advice(). The patch that introduced the dst_hold() in ip6_negative_advice() was 92f1655aa2b22 ("net: fix __dst_negative_advice() race"). But 92f1655aa2b22 merely refactored the code with regards to the dst refcount so the issue was present even before 92f1655aa2b22. The bug was introduced in 54c1a859efd9f ("ipv6: Don't drop cache route entry unless timer actually expired.") where the expired cached route is deleted and the sk_dst_cache member of the socket is set to NULL by calling dst_negative_advice() but the refcount belonging to the socket is left unbalanced. The IPv4 version - ipv4_negative_advice() - is not affected by this bug. When the TCP connection times out ipv4_negative_advice() merely resets the sk_dst_cache of the socket while decrementing the refcount of the exception dst.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 54c1a859efd9fd6cda05bc700315ba2519c14eba , < a95808252e8acc0123bacd2dff8b9af10bc145b7 (git)
Affected: 54c1a859efd9fd6cda05bc700315ba2519c14eba , < b90d061345bb8cd51fece561a800bae1c95448a6 (git)
Affected: 54c1a859efd9fd6cda05bc700315ba2519c14eba , < 0b8903e6c881f72c6849d4952de742c656eb5ab9 (git)
Affected: 54c1a859efd9fd6cda05bc700315ba2519c14eba , < 535add1e9f274502209cb997801208bbe1ae6c6f (git)
Affected: 54c1a859efd9fd6cda05bc700315ba2519c14eba , < f43d12fd0fa8ee5b9caf8a3927e10d06431764d2 (git)
Affected: 54c1a859efd9fd6cda05bc700315ba2519c14eba , < 8b591bd522b71c42a82898290e35d32b482047e4 (git)
Affected: 54c1a859efd9fd6cda05bc700315ba2519c14eba , < 3301ab7d5aeb0fe270f73a3d4810c9d1b6a9f045 (git)
Affected: 9c93e9c757c7d3d96027a06b9b4c4e37ca87ded7 (git)
Affected: 2.6.33.2 , < 2.6.34 (semver)
Create a notification for this product.
Linux Linux Affected: 2.6.34
Unaffected: 0 , < 2.6.34 (semver)
Unaffected: 5.4.287 , ≤ 5.4.* (semver)
Unaffected: 5.10.231 , ≤ 5.10.* (semver)
Unaffected: 5.15.174 , ≤ 5.15.* (semver)
Unaffected: 6.1.120 , ≤ 6.1.* (semver)
Unaffected: 6.6.66 , ≤ 6.6.* (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:51:48.405Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a95808252e8acc0123bacd2dff8b9af10bc145b7",
              "status": "affected",
              "version": "54c1a859efd9fd6cda05bc700315ba2519c14eba",
              "versionType": "git"
            },
            {
              "lessThan": "b90d061345bb8cd51fece561a800bae1c95448a6",
              "status": "affected",
              "version": "54c1a859efd9fd6cda05bc700315ba2519c14eba",
              "versionType": "git"
            },
            {
              "lessThan": "0b8903e6c881f72c6849d4952de742c656eb5ab9",
              "status": "affected",
              "version": "54c1a859efd9fd6cda05bc700315ba2519c14eba",
              "versionType": "git"
            },
            {
              "lessThan": "535add1e9f274502209cb997801208bbe1ae6c6f",
              "status": "affected",
              "version": "54c1a859efd9fd6cda05bc700315ba2519c14eba",
              "versionType": "git"
            },
            {
              "lessThan": "f43d12fd0fa8ee5b9caf8a3927e10d06431764d2",
              "status": "affected",
              "version": "54c1a859efd9fd6cda05bc700315ba2519c14eba",
              "versionType": "git"
            },
            {
              "lessThan": "8b591bd522b71c42a82898290e35d32b482047e4",
              "status": "affected",
              "version": "54c1a859efd9fd6cda05bc700315ba2519c14eba",
              "versionType": "git"
            },
            {
              "lessThan": "3301ab7d5aeb0fe270f73a3d4810c9d1b6a9f045",
              "status": "affected",
              "version": "54c1a859efd9fd6cda05bc700315ba2519c14eba",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9c93e9c757c7d3d96027a06b9b4c4e37ca87ded7",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.34",
              "status": "affected",
              "version": "2.6.33.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.287",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.174",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.287",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.231",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.174",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.120",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.33.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/ipv6: release expired exception dst cached in socket\n\nDst objects get leaked in ip6_negative_advice() when this function is\nexecuted for an expired IPv6 route located in the exception table. There\nare several conditions that must be fulfilled for the leak to occur:\n* an ICMPv6 packet indicating a change of the MTU for the path is received,\n  resulting in an exception dst being created\n* a TCP connection that uses the exception dst for routing packets must\n  start timing out so that TCP begins retransmissions\n* after the exception dst expires, the FIB6 garbage collector must not run\n  before TCP executes ip6_negative_advice() for the expired exception dst\n\nWhen TCP executes ip6_negative_advice() for an exception dst that has\nexpired and if no other socket holds a reference to the exception dst, the\nrefcount of the exception dst is 2, which corresponds to the increment\nmade by dst_init() and the increment made by the TCP socket for which the\nconnection is timing out. The refcount made by the socket is never\nreleased. The refcount of the dst is decremented in sk_dst_reset() but\nthat decrement is counteracted by a dst_hold() intentionally placed just\nbefore the sk_dst_reset() in ip6_negative_advice(). After\nip6_negative_advice() has finished, there is no other object tied to the\ndst. The socket lost its reference stored in sk_dst_cache and the dst is\nno longer in the exception table. The exception dst becomes a leaked\nobject.\n\nAs a result of this dst leak, an unbalanced refcount is reported for the\nloopback device of a net namespace being destroyed under kernels that do\nnot contain e5f80fcf869a (\"ipv6: give an IPv6 dev to blackhole_netdev\"):\nunregister_netdevice: waiting for lo to become free. Usage count = 2\n\nFix the dst leak by removing the dst_hold() in ip6_negative_advice(). The\npatch that introduced the dst_hold() in ip6_negative_advice() was\n92f1655aa2b22 (\"net: fix __dst_negative_advice() race\"). But 92f1655aa2b22\nmerely refactored the code with regards to the dst refcount so the issue\nwas present even before 92f1655aa2b22. The bug was introduced in\n54c1a859efd9f (\"ipv6: Don\u0027t drop cache route entry unless timer actually\nexpired.\") where the expired cached route is deleted and the sk_dst_cache\nmember of the socket is set to NULL by calling dst_negative_advice() but\nthe refcount belonging to the socket is left unbalanced.\n\nThe IPv4 version - ipv4_negative_advice() - is not affected by this bug.\nWhen the TCP connection times out ipv4_negative_advice() merely resets the\nsk_dst_cache of the socket while decrementing the refcount of the\nexception dst."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:55:43.931Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a95808252e8acc0123bacd2dff8b9af10bc145b7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b90d061345bb8cd51fece561a800bae1c95448a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0b8903e6c881f72c6849d4952de742c656eb5ab9"
        },
        {
          "url": "https://git.kernel.org/stable/c/535add1e9f274502209cb997801208bbe1ae6c6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f43d12fd0fa8ee5b9caf8a3927e10d06431764d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8b591bd522b71c42a82898290e35d32b482047e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/3301ab7d5aeb0fe270f73a3d4810c9d1b6a9f045"
        }
      ],
      "title": "net/ipv6: release expired exception dst cached in socket",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56644",
    "datePublished": "2024-12-27T15:02:45.664Z",
    "dateReserved": "2024-12-27T15:00:39.840Z",
    "dateUpdated": "2026-05-23T15:55:43.931Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56644",
      "date": "2026-06-05",
      "epss": "8e-05",
      "percentile": "0.00702"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/ipv6: release expired exception dst cached in socket\\n\\nDst objects get leaked in ip6_negative_advice() when this function is\\nexecuted for an expired IPv6 route located in the exception table. There\\nare several conditions that must be fulfilled for the leak to occur:\\n* an ICMPv6 packet indicating a change of the MTU for the path is received,\\n  resulting in an exception dst being created\\n* a TCP connection that uses the exception dst for routing packets must\\n  start timing out so that TCP begins retransmissions\\n* after the exception dst expires, the FIB6 garbage collector must not run\\n  before TCP executes ip6_negative_advice() for the expired exception dst\\n\\nWhen TCP executes ip6_negative_advice() for an exception dst that has\\nexpired and if no other socket holds a reference to the exception dst, the\\nrefcount of the exception dst is 2, which corresponds to the increment\\nmade by dst_init() and the increment made by the TCP socket for which the\\nconnection is timing out. The refcount made by the socket is never\\nreleased. The refcount of the dst is decremented in sk_dst_reset() but\\nthat decrement is counteracted by a dst_hold() intentionally placed just\\nbefore the sk_dst_reset() in ip6_negative_advice(). After\\nip6_negative_advice() has finished, there is no other object tied to the\\ndst. The socket lost its reference stored in sk_dst_cache and the dst is\\nno longer in the exception table. The exception dst becomes a leaked\\nobject.\\n\\nAs a result of this dst leak, an unbalanced refcount is reported for the\\nloopback device of a net namespace being destroyed under kernels that do\\nnot contain e5f80fcf869a (\\\"ipv6: give an IPv6 dev to blackhole_netdev\\\"):\\nunregister_netdevice: waiting for lo to become free. Usage count = 2\\n\\nFix the dst leak by removing the dst_hold() in ip6_negative_advice(). The\\npatch that introduced the dst_hold() in ip6_negative_advice() was\\n92f1655aa2b22 (\\\"net: fix __dst_negative_advice() race\\\"). But 92f1655aa2b22\\nmerely refactored the code with regards to the dst refcount so the issue\\nwas present even before 92f1655aa2b22. The bug was introduced in\\n54c1a859efd9f (\\\"ipv6: Don\u0027t drop cache route entry unless timer actually\\nexpired.\\\") where the expired cached route is deleted and the sk_dst_cache\\nmember of the socket is set to NULL by calling dst_negative_advice() but\\nthe refcount belonging to the socket is left unbalanced.\\n\\nThe IPv4 version - ipv4_negative_advice() - is not affected by this bug.\\nWhen the TCP connection times out ipv4_negative_advice() merely resets the\\nsk_dst_cache of the socket while decrementing the refcount of the\\nexception dst.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/ipv6: liberaci\\u00f3n de la excepci\\u00f3n dst expirada almacenada en cach\\u00e9 en el socket. Los objetos Dst se filtran en ip6_negative_advice() cuando se ejecuta esta funci\\u00f3n para una ruta IPv6 expirada ubicada en la tabla de excepciones. Hay varias condiciones que deben cumplirse para que se produzca la fuga: * se recibe un paquete ICMPv6 que indica un cambio de la MTU para la ruta, lo que da como resultado la creaci\\u00f3n de un dst de excepci\\u00f3n * una conexi\\u00f3n TCP que utiliza el dst de excepci\\u00f3n para enrutar paquetes debe comenzar a agotar el tiempo de espera para que TCP comience las retransmisiones * despu\\u00e9s de que el dst de excepci\\u00f3n caduque, el recolector de basura FIB6 no debe ejecutarse antes de que TCP ejecute ip6_negative_advice() para el dst de excepci\\u00f3n caducado Cuando TCP ejecuta ip6_negative_advice() para un dst de excepci\\u00f3n que ha caducado y si ning\\u00fan otro socket tiene una referencia al dst de excepci\\u00f3n, el recuento de referencias del dst de excepci\\u00f3n es 2, que corresponde al incremento realizado por dst_init() y el incremento realizado por el socket TCP para el que se agota el tiempo de espera de la conexi\\u00f3n. El recuento de referencias realizado por el socket nunca se libera. El recuento de referencias del dst se reduce en sk_dst_reset() pero esa reducci\\u00f3n se contrarresta con un dst_hold() colocado intencionalmente justo antes del sk_dst_reset() en ip6_negative_advice(). Despu\\u00e9s de que ip6_negative_advice() haya terminado, no hay otro objeto vinculado al dst. El socket perdi\\u00f3 su referencia almacenada en sk_dst_cache y el dst ya no est\\u00e1 en la tabla de excepciones. El dst de excepci\\u00f3n se convierte en un objeto filtrado. Como resultado de esta filtraci\\u00f3n de dst, se informa un recuento de referencias desequilibrado para el dispositivo de bucle invertido de un espacio de nombres de red que se destruye en n\\u00facleos que no contienen e5f80fcf869a (\\\"ipv6: dar un dev IPv6 a blackhole_netdev\\\"): unregister_netdevice: esperando a que lo se libere. Recuento de uso = 2 Corrija la filtraci\\u00f3n de dst eliminando dst_hold() en ip6_negative_advice(). El parche que introdujo dst_hold() en ip6_negative_advice() fue 92f1655aa2b22 (\\\"net: fix __dst_negative_advice() race\\\"). Pero 92f1655aa2b22 simplemente refactoriz\\u00f3 el c\\u00f3digo con respecto al recuento de referencias dst, por lo que el problema estaba presente incluso antes de 92f1655aa2b22. El error se introdujo en 54c1a859efd9f (\\\"ipv6: Don\u0027t drop cache route entry sometimes expired.\\\") donde la ruta en cach\\u00e9 expirada se elimina y el miembro sk_dst_cache del socket se establece en NULL al llamar a dst_negative_advice(), pero el recuento de referencias que pertenece al socket se deja desequilibrado. La versi\\u00f3n IPv4 - ipv4_negative_advice() - no se ve afectada por este error. Cuando se agota el tiempo de conexi\\u00f3n TCP, ipv4_negative_advice() simplemente restablece el sk_dst_cache del socket mientras disminuye el recuento de referencias del dst de excepci\\u00f3n.\"}]",
      "id": "CVE-2024-56644",
      "lastModified": "2024-12-27T15:15:24.163",
      "published": "2024-12-27T15:15:24.163",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0b8903e6c881f72c6849d4952de742c656eb5ab9\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3301ab7d5aeb0fe270f73a3d4810c9d1b6a9f045\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/535add1e9f274502209cb997801208bbe1ae6c6f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/8b591bd522b71c42a82898290e35d32b482047e4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a95808252e8acc0123bacd2dff8b9af10bc145b7\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/b90d061345bb8cd51fece561a800bae1c95448a6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f43d12fd0fa8ee5b9caf8a3927e10d06431764d2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56644\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:24.163\",\"lastModified\":\"2026-01-12T13:10:13.060\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/ipv6: release expired exception dst cached in socket\\n\\nDst objects get leaked in ip6_negative_advice() when this function is\\nexecuted for an expired IPv6 route located in the exception table. There\\nare several conditions that must be fulfilled for the leak to occur:\\n* an ICMPv6 packet indicating a change of the MTU for the path is received,\\n  resulting in an exception dst being created\\n* a TCP connection that uses the exception dst for routing packets must\\n  start timing out so that TCP begins retransmissions\\n* after the exception dst expires, the FIB6 garbage collector must not run\\n  before TCP executes ip6_negative_advice() for the expired exception dst\\n\\nWhen TCP executes ip6_negative_advice() for an exception dst that has\\nexpired and if no other socket holds a reference to the exception dst, the\\nrefcount of the exception dst is 2, which corresponds to the increment\\nmade by dst_init() and the increment made by the TCP socket for which the\\nconnection is timing out. The refcount made by the socket is never\\nreleased. The refcount of the dst is decremented in sk_dst_reset() but\\nthat decrement is counteracted by a dst_hold() intentionally placed just\\nbefore the sk_dst_reset() in ip6_negative_advice(). After\\nip6_negative_advice() has finished, there is no other object tied to the\\ndst. The socket lost its reference stored in sk_dst_cache and the dst is\\nno longer in the exception table. The exception dst becomes a leaked\\nobject.\\n\\nAs a result of this dst leak, an unbalanced refcount is reported for the\\nloopback device of a net namespace being destroyed under kernels that do\\nnot contain e5f80fcf869a (\\\"ipv6: give an IPv6 dev to blackhole_netdev\\\"):\\nunregister_netdevice: waiting for lo to become free. Usage count = 2\\n\\nFix the dst leak by removing the dst_hold() in ip6_negative_advice(). The\\npatch that introduced the dst_hold() in ip6_negative_advice() was\\n92f1655aa2b22 (\\\"net: fix __dst_negative_advice() race\\\"). But 92f1655aa2b22\\nmerely refactored the code with regards to the dst refcount so the issue\\nwas present even before 92f1655aa2b22. The bug was introduced in\\n54c1a859efd9f (\\\"ipv6: Don\u0027t drop cache route entry unless timer actually\\nexpired.\\\") where the expired cached route is deleted and the sk_dst_cache\\nmember of the socket is set to NULL by calling dst_negative_advice() but\\nthe refcount belonging to the socket is left unbalanced.\\n\\nThe IPv4 version - ipv4_negative_advice() - is not affected by this bug.\\nWhen the TCP connection times out ipv4_negative_advice() merely resets the\\nsk_dst_cache of the socket while decrementing the refcount of the\\nexception dst.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/ipv6: liberaci\u00f3n de la excepci\u00f3n dst expirada almacenada en cach\u00e9 en el socket. Los objetos Dst se filtran en ip6_negative_advice() cuando se ejecuta esta funci\u00f3n para una ruta IPv6 expirada ubicada en la tabla de excepciones. Hay varias condiciones que deben cumplirse para que se produzca la fuga: * se recibe un paquete ICMPv6 que indica un cambio de la MTU para la ruta, lo que da como resultado la creaci\u00f3n de un dst de excepci\u00f3n * una conexi\u00f3n TCP que utiliza el dst de excepci\u00f3n para enrutar paquetes debe comenzar a agotar el tiempo de espera para que TCP comience las retransmisiones * despu\u00e9s de que el dst de excepci\u00f3n caduque, el recolector de basura FIB6 no debe ejecutarse antes de que TCP ejecute ip6_negative_advice() para el dst de excepci\u00f3n caducado Cuando TCP ejecuta ip6_negative_advice() para un dst de excepci\u00f3n que ha caducado y si ning\u00fan otro socket tiene una referencia al dst de excepci\u00f3n, el recuento de referencias del dst de excepci\u00f3n es 2, que corresponde al incremento realizado por dst_init() y el incremento realizado por el socket TCP para el que se agota el tiempo de espera de la conexi\u00f3n. El recuento de referencias realizado por el socket nunca se libera. El recuento de referencias del dst se reduce en sk_dst_reset() pero esa reducci\u00f3n se contrarresta con un dst_hold() colocado intencionalmente justo antes del sk_dst_reset() en ip6_negative_advice(). Despu\u00e9s de que ip6_negative_advice() haya terminado, no hay otro objeto vinculado al dst. El socket perdi\u00f3 su referencia almacenada en sk_dst_cache y el dst ya no est\u00e1 en la tabla de excepciones. El dst de excepci\u00f3n se convierte en un objeto filtrado. Como resultado de esta filtraci\u00f3n de dst, se informa un recuento de referencias desequilibrado para el dispositivo de bucle invertido de un espacio de nombres de red que se destruye en n\u00facleos que no contienen e5f80fcf869a (\\\"ipv6: dar un dev IPv6 a blackhole_netdev\\\"): unregister_netdevice: esperando a que lo se libere. Recuento de uso = 2 Corrija la filtraci\u00f3n de dst eliminando dst_hold() en ip6_negative_advice(). El parche que introdujo dst_hold() en ip6_negative_advice() fue 92f1655aa2b22 (\\\"net: fix __dst_negative_advice() race\\\"). Pero 92f1655aa2b22 simplemente refactoriz\u00f3 el c\u00f3digo con respecto al recuento de referencias dst, por lo que el problema estaba presente incluso antes de 92f1655aa2b22. El error se introdujo en 54c1a859efd9f (\\\"ipv6: Don\u0027t drop cache route entry sometimes expired.\\\") donde la ruta en cach\u00e9 expirada se elimina y el miembro sk_dst_cache del socket se establece en NULL al llamar a dst_negative_advice(), pero el recuento de referencias que pertenece al socket se deja desequilibrado. La versi\u00f3n IPv4 - ipv4_negative_advice() - no se ve afectada por este error. Cuando se agota el tiempo de conexi\u00f3n TCP, ipv4_negative_advice() simplemente restablece el sk_dst_cache del socket mientras disminuye el recuento de referencias del dst de excepci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.33.2\",\"versionEndExcluding\":\"2.6.34\",\"matchCriteriaId\":\"E158B442-2610-44C5-B45E-84AFBBEFF4CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.34.1\",\"versionEndExcluding\":\"5.4.287\",\"matchCriteriaId\":\"F2978425-8E5C-4FA6-9AA6-1B6069166145\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.231\",\"matchCriteriaId\":\"B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.174\",\"matchCriteriaId\":\"419FD073-1517-4FD5-8158-F94BC68A1E89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.120\",\"matchCriteriaId\":\"09AC6122-E2A4-40FE-9D33-268A1B2EC265\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"29A976AD-B9AB-4A95-9F08-7669F8847EB9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3B1BC1D-ED46-4364-A1D9-1FA74182B03A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"7927713B-5EB0-41EB-86A9-9935775162E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"59037296-3143-4FBB-AFF7-D4FE2C85502F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CA27FD5-7DBF-4C85-80A9-D523B2E4B033\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9711E333-A8E7-4F4B-BCFD-2023E889651A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:2.6.34:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"E04D3358-973B-42A1-8E08-2E3AE947193C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0b8903e6c881f72c6849d4952de742c656eb5ab9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3301ab7d5aeb0fe270f73a3d4810c9d1b6a9f045\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/535add1e9f274502209cb997801208bbe1ae6c6f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8b591bd522b71c42a82898290e35d32b482047e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a95808252e8acc0123bacd2dff8b9af10bc145b7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b90d061345bb8cd51fece561a800bae1c95448a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f43d12fd0fa8ee5b9caf8a3927e10d06431764d2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.