CVE-2024-53206

Summary

CVE-2024-53206 is a newly discovered vulnerability affecting the Linux kernel. This issue involves a use-after-free bug in the tcp subsystem, specifically in the reqsk_timer_handler() function. When a retry attempt fails, and the reqsk is migrated, the nreq pointer can be accessed after it has been freed, leading to potential memory corruption. The vulnerability has been mitigated by replacing inet_csk_reqsk_queue_drop_and_put() with __inet_csk_reqsk_queue_drop() and reqsk_put() in the affected function. Now, oreq is passed to reqsk_put() instead of req, preventing the use-after-free condition.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.