CVE-2024-35908

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-35908
In the Linux kernel, the following vulnerability has been resolved: tls: get psock ref after taking rxlock to avoid leak At the start of tls_sw_recvmsg, we take a reference on the psock, and then call tls_rx_reader_lock. If that fails, we return directly without releasing the reference. Instead of adding a new label, just take the reference after locking has succeeded, since we don't need it before.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/30fabe50a7ace3e9d57cf7f9288f33ea408491c8 Patch
https://git.kernel.org/stable/c/417e91e856099e9b8a42a2520e2255e6afe024be Patch
https://git.kernel.org/stable/c/b565d294e3d5aa809566a4d819835da11997d8b3 Patch
https://git.kernel.org/stable/c/f1b7f14130d782433bc98c1e1e41ce6b4d4c3096 Patch
https://git.kernel.org/stable/c/30fabe50a7ace3e9d57cf7f9288f33ea408491c8 Patch
https://git.kernel.org/stable/c/417e91e856099e9b8a42a2520e2255e6afe024be Patch
https://git.kernel.org/stable/c/b565d294e3d5aa809566a4d819835da11997d8b3 Patch
https://git.kernel.org/stable/c/f1b7f14130d782433bc98c1e1e41ce6b4d4c3096 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
History

24 Sep 2025, 18:52

Type Values Removed Values Added
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/30fabe50a7ace3e9d57cf7f9288f33ea408491c8 - () https://git.kernel.org/stable/c/30fabe50a7ace3e9d57cf7f9288f33ea408491c8 - Patch
References () https://git.kernel.org/stable/c/417e91e856099e9b8a42a2520e2255e6afe024be - () https://git.kernel.org/stable/c/417e91e856099e9b8a42a2520e2255e6afe024be - Patch
References () https://git.kernel.org/stable/c/b565d294e3d5aa809566a4d819835da11997d8b3 - () https://git.kernel.org/stable/c/b565d294e3d5aa809566a4d819835da11997d8b3 - Patch
References () https://git.kernel.org/stable/c/f1b7f14130d782433bc98c1e1e41ce6b4d4c3096 - () https://git.kernel.org/stable/c/f1b7f14130d782433bc98c1e1e41ce6b4d4c3096 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401

21 Nov 2024, 09:21

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/30fabe50a7ace3e9d57cf7f9288f33ea408491c8 - () https://git.kernel.org/stable/c/30fabe50a7ace3e9d57cf7f9288f33ea408491c8 -
References () https://git.kernel.org/stable/c/417e91e856099e9b8a42a2520e2255e6afe024be - () https://git.kernel.org/stable/c/417e91e856099e9b8a42a2520e2255e6afe024be -
References () https://git.kernel.org/stable/c/b565d294e3d5aa809566a4d819835da11997d8b3 - () https://git.kernel.org/stable/c/b565d294e3d5aa809566a4d819835da11997d8b3 -
References () https://git.kernel.org/stable/c/f1b7f14130d782433bc98c1e1e41ce6b4d4c3096 - () https://git.kernel.org/stable/c/f1b7f14130d782433bc98c1e1e41ce6b4d4c3096 -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tls: obtenga referencia de psock después de tomar rxlock para evitar fugas. Al inicio de tls_sw_recvmsg, tomamos una referencia en psock y luego llamamos a tls_rx_reader_lock. Si eso falla, volvemos directamente sin liberar la referencia. En lugar de agregar una nueva etiqueta, simplemente tome la referencia después de que el bloqueo se haya realizado correctamente, ya que no la necesitamos antes.

19 May 2024, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-19 09:15

Updated : 2025-09-24 18:52

NVD link : CVE-2024-35908

Mitre link : CVE-2024-35908

CVE.ORG link : CVE-2024-35908

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime