CVE-2024-56643

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dccp: Fix memory leak in dccp_feat_change_recv

If dccp_feat_push_confirm() fails after new value for SP feature was accepted

without reconciliation ('entry == NULL' branch), memory allocated for that value

with dccp_feat_clone_sp_val() is never freed.

Here is the kmemleak stack for this:

unreferenced object 0xffff88801d4ab488 (size 8):

comm "syz-executor310", pid 1127, jiffies 4295085598 (age 41.666s)

hex dump (first 8 bytes):

01 b4 4a 1d 80 88 ff ff ..J.....

backtrace:

[<00000000db7cabfe>] kmemdup+0x23/0x50 mm/util.c:128

[<0000000019b38405>] kmemdup include/linux/string.h:465 [inline]

[<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:371 [inline]

[<0000000019b38405>] dccp_feat_clone_sp_val net/dccp/feat.c:367 [inline]

[<0000000019b38405>] dccp_feat_change_recv net/dccp/feat.c:1145 [inline]

[<0000000019b38405>] dccp_feat_parse_options+0x1196/0x218

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References