CVE-2024-56600

Summary

CVE-2024-56600 is a newly identified vulnerability in the Linux kernel that could lead to use-after-free conditions. Specifically, inet6: inet6_create() function fails to clear the socket (sk) pointer when the function fails, resulting in a dangling sk pointer. This issue arises because sock_init_data() attaches the allocated sk pointer to the provided sock object, but inet6_create() may release the sk object if the function call fails. Consequently, the sock object retains the dangling sk pointer, which may be exploited later. To mitigate this vulnerability, the Linux kernel now clears the sock sk pointer on error.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.