CVE-2024-38602

Medium

In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issues of ax25_dev The ax25_addr_ax25dev() and ax25_dev_device_down() exist a reference count leak issue of the object "ax25_dev". Memory leak issue in ax25_addr_ax25dev(): The reference count of the object "ax25_dev" can be increased multiple times in ax25_addr_ax25dev(). This will cause a memory leak. Memory leak issues in ax25_dev_device_down(): The reference count of ax25_dev is set to 1 in ax25_dev_device_up() and then increase the reference count when ax25_dev is added to ax25_dev_list. As a result, the reference count of ax25_dev is 2. But when the device is shutting down. The ax25_dev_device_down() drops the reference count once or twice depending on if we goto unlock_put or not, which will cause memory leak. As for the issue of ax25_addr_ax25dev(), it is impossible for one pointer to be on a list twice. So add a break in ax25_addr_ax25dev(). As for the issue of ax25_dev_device_down(), increase the reference count of ax25_dev once in ax25_dev_device_up() and decrease the reference count of ax25_dev after it is removed from the ax25_dev_list.

Package Linux Kernel
Published 2024-06-19
Last modified 2024-11-21
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

5.5

out of 10
Medium
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions

Linux kernel versions 4.14.277, 4.19.240, 5.4.190, 5.10.112, 5.15.35, 5.17 and later are affected. Fixed in 6.1.93, 6.6.33, 6.8.12, 6.9.3, 6.10 and their respective stable series.

Affected from
≥ 4.14.277 ≥ 4.19.240 ≥ 5.4.190 ≥ 5.10.112 ≥ 5.15.35 ≥ 5.17
Fixed in
✓ 6.1.93 6.1.x ✓ 6.6.33 6.6.x ✓ 6.8.12 6.8.x ✓ 6.9.3 6.9.x ✓ 6.10

References

5 total

Frequently asked questions

  • What is CVE-2024-38602?

    CVE-2024-38602 is a Medium severity Linux kernel vulnerability with a CVSS score of 5.5 out of 10 . It affects Linux kernel versions from 4.14.277 onward and has been patched in 6.1.93, 6.6.33, 6.8.12 and others. CVE-2024-38602 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2024-38602?

    CVE-2024-38602 has a CVSS score of 5.5 out of 10, rated Medium severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H .

  • Is there a patch available for CVE-2024-38602?

    Yes. CVE-2024-38602 has been patched. Fixed versions include 6.1.93, 6.6.33, 6.8.12 and others. If you are running Linux kernel 4.14.277 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2024-38602 actively exploited?

    No. CVE-2024-38602 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST