Executive brief
A vulnerability in the Linux kernel's NET/ROM protocol implementation can lead to a memory leak. This component is used for amateur radio networking. An attacker could exploit this to gradually consume system memory, potentially leading to a system crash or service instability.
Technical details
A memory leak exists in the netrom implementation within the Linux kernel. The root cause is an incorrect reference count increment (sock_hold) in the nr_heartbeat_expiry() function. Specifically, when a socket has the SOCK_DESTROY flag set, the kernel was holding a reference that would never be released because the file descriptor was already closed and nr_release() had already been called. This prevents the socket from being properly freed. The fix restricts the sock_hold() call to only occur for listening sockets. This can be triggered by a local user and results in a denial-of-service condition via memory exhaustion.
Affected products
- Linux Linux Kernel 4.19.272 to 4.19.317, 5.4.231 to 5.4.279, 5.10.166 to 5.10.221, 5.15.91 to 5.15.162, 6.1.9 to 6.1.96, 6.2 to 6.6.36, 6.7 to 6.9.7
Timeline
- 2024-06-17: patched: Initial fix committed to mainline kernel
- 2024-07-12: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0b9130247f3b6a1122478471ff0e014ea96bb735
- https://git.kernel.org/stable/c/280cf1173726a7059b628c610c71050d5c0b6937
- https://git.kernel.org/stable/c/5391f9db2cab5ef1cb411be1ab7dbec728078fba
- https://git.kernel.org/stable/c/a02fd5d775cf9787ee7698c797e20f2fa13d2e2b
- https://git.kernel.org/stable/c/b6ebe4fed73eedeb73f4540f8edc4871945474c8
- https://git.kernel.org/stable/c/d377f5a28332954b19e373d36823e59830ab1712
- https://git.kernel.org/stable/c/d616876256b38ecf9a1a1c7d674192c5346bc69c