{"id":"CVE-2024-56606","state":"PUBLISHED","title":"af_packet: avoid erroring out after sock_init_data() in packet_create()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: avoid erroring out after sock_init_data() in packet_create()\n\nAfter sock_init_data() the allocated sk object is attached to the provided\nsock object. On error, packet_create() frees the sk object leaving the\ndangling pointer in the sock object on return. Some other code may try\nto use this pointer and cause use-after-free.","publishedAt":"2024-12-27T14:51:11.327Z","updatedAt":"2026-10-15T00:59:48.866Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"71b22837a5e55ac27d6a14b9cdf2326587405c4f","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"1dc1e1db927056cb323296e2294a855cd003dfe7","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"132e615bb1d7cdec2d3cfbdec2efa630e923fd21","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"a6cf750b737374454a4e03a5ed449a3eb0c96414","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"157f08db94123e2ba56877dd0ac88908b13a5dd0","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"fd09880b16d33aa5a7420578e01cd79148fa9829","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"46f2a11cb82b657fd15bab1c47821b635e03838b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/packet/af_packet.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.14","versionType":"semver"},{"version":"5.4.287","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.231","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.174","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.120","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.66","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.5","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/packet/af_packet.c"]}],"references":["https://git.kernel.org/stable/c/71b22837a5e55ac27d6a14b9cdf2326587405c4f","https://git.kernel.org/stable/c/1dc1e1db927056cb323296e2294a855cd003dfe7","https://git.kernel.org/stable/c/132e615bb1d7cdec2d3cfbdec2efa630e923fd21","https://git.kernel.org/stable/c/a6cf750b737374454a4e03a5ed449a3eb0c96414","https://git.kernel.org/stable/c/157f08db94123e2ba56877dd0ac88908b13a5dd0","https://git.kernel.org/stable/c/fd09880b16d33aa5a7420578e01cd79148fa9829","https://git.kernel.org/stable/c/46f2a11cb82b657fd15bab1c47821b635e03838b","https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html","https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-355557.html"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:08:12.933Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/56xxx/CVE-2024-56606.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-56606","state":"PUBLISHED","datePublished":"2024-12-27T14:51:11.327Z","dateUpdated":"2026-10-15T00:59:48.866Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-12-27T14:03:06.013Z"},"containers":{"cna":{"title":"af_packet: avoid erroring out after sock_init_data() in packet_create()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_packet: avoid erroring out after sock_init_data() in packet_create()\n\nAfter sock_init_data() the allocated sk object is attached to the provided\nsock object. On error, packet_create() frees the sk object leaving the\ndangling pointer in the sock object on return. Some other code may try\nto use this pointer and cause use-after-free."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"71b22837a5e55ac27d6a14b9cdf2326587405c4f","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"1dc1e1db927056cb323296e2294a855cd003dfe7","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"132e615bb1d7cdec2d3cfbdec2efa630e923fd21","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"a6cf750b737374454a4e03a5ed449a3eb0c96414","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"157f08db94123e2ba56877dd0ac88908b13a5dd0","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"fd09880b16d33aa5a7420578e01cd79148fa9829","versionType":"git"},{"version":"b013840810c221f2b0cf641d01531526052dc1fb","status":"affected","lessThan":"46f2a11cb82b657fd15bab1c47821b635e03838b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/packet/af_packet.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.14","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.14","versionType":"semver"},{"version":"5.4.287","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.231","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.174","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.120","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.66","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.5","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.13","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/packet/af_packet.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/71b22837a5e55ac27d6a14b9cdf2326587405c4f"},{"url":"https://git.kernel.org/stable/c/1dc1e1db927056cb323296e2294a855cd003dfe7"},{"url":"https://git.kernel.org/stable/c/132e615bb1d7cdec2d3cfbdec2efa630e923fd21"},{"url":"https://git.kernel.org/stable/c/a6cf750b737374454a4e03a5ed449a3eb0c96414"},{"url":"https://git.kernel.org/stable/c/157f08db94123e2ba56877dd0ac88908b13a5dd0"},{"url":"https://git.kernel.org/stable/c/fd09880b16d33aa5a7420578e01cd79148fa9829"},{"url":"https://git.kernel.org/stable/c/46f2a11cb82b657fd15bab1c47821b635e03838b"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is reached purely through the local `socket(AF_PACKET, ...)` syscall path (`__sys_socket` → `__sock_create` → `packet_create`); no network packet or remote peer is involved in triggering it.\nAC:L - The attacker controls both preconditions — they can exhaust percpu/slab memory themselves (mass socket and BPF-map allocation, netns churn) and retry the cheap `socket()` call in an unbounded loop until `alloc_percpu()` fails, and can heap-spray the generic kmalloc cache to reclaim the freed `packet_sock`.\nPR:L - The only gate is `ns_capable(net->user_ns, CAP_NET_RAW)` at af_packet.c:3394, which any unprivileged user satisfies inside a user+network namespace (`unshare -Urn`), and which containers hold by default.\nUI:N - The attacker triggers the entire sequence from their own process via repeated `socket()` calls; no action by any other user or administrator is required.\nS:U - The dangling pointer, the freed object, and the resulting corruption are all within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The use-after-free reads freed slab memory (`atomic64_read(&sk->sk_cookie)` in `__sock_gen_cookie()`), and since `packet_sock` comes from a generic kmalloc cache the attacker can reclaim the object with sprayed content, turning this into a controllable kernel memory disclosure primitive.\nI:H - `__sock_gen_cookie()` performs an `atomic64_cmpxchg()` on the freed object — an 8-byte write into attacker-reclaimed slab memory at a controlled offset, which is a classic stepping stone to control-flow hijack and privilege escalation.\nA:H - Dereferencing the dangling `sock->sk` after `sk_free()` corrupts freed slab memory and reliably produces a KASAN splat, oops, or panic, as shown in the reference report for this bug class."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:45:27.108Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"5.4.287"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"5.10.231"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"5.15.174"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.1.120"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.6.66"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.12.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.14","versionEndExcluding":"6.13"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.8,"attackVector":"LOCAL","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2024-56606","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-02-11T15:42:04.007778Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-02-11T15:45:22.662Z"}},{"title":"CVE Program Container","references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-03T20:50:53.934Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.2","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:59:48.866Z"},"x_adpType":"supplier"}]}}}