CVE-2024-56643

Summary

CVE-2024-56643: A memory leak vulnerability has been identified and resolved in the Linux kernel's dccp module. The issue occurs when dccp_feat_push_confirm() fails during the acceptance of a new SP feature value without reconciliation, resulting in the allocated memory for that value with dccp_feat_clone_sp_val() not being freed. This leads to an unreferenced object in the kernel, which can be seen in the provided kmemleak stack trace. The vulnerability was discovered by the Linux Verification Center using Syzkaller. To mitigate this issue, the kernel now cleans up and bails out with an error reset code when dccp_feat_push_confirm() fails.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.