Description
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount imbalance on inbound connections When releasing a socket in ax25_release(), we call netdev_put() to decrease the refcount on the associated ax.25 device. However, the execution path for accepting an incoming connection never calls netdev_hold(). This imbalance leads to refcount errors, and ultimately to kernel crashes. A typical call trace for the above situation will start with one of the following errors: refcount_t: decrement hit 0; leaking memory. refcount_t: underflow; use-after-free. And will then have a trace like: Call Trace: ? show_regs+0x64/0x70 ? __warn+0x83/0x120 ? refcount_warn_saturate+0xb2/0x100 ? report_bug+0x158/0x190 ? prb_read_valid+0x20/0x30 ? handle_bug+0x3e/0x70 ? exc_invalid_op+0x1c/0x70 ? asm_exc_invalid_op+0x1f/0x30 ? refcount_warn_saturate+0xb2/0x100 ? refcount_warn_saturate+0xb2/0x100 ax25_release+0x2ad/0x360 __sock_release+0x35/0xa0 sock_close+0x19/0x20 [...] On reboot (or any attempt to remove the interface), the kernel gets stuck in an infinite loop: unregister_netdevice: waiting for ax0 to become free. Usage count = 0 This patch corrects these issues by ensuring that we call netdev_hold() and ax25_dev_hold() for new connections in ax25_accept(). This makes the logic leading to ax25_accept() match the logic for ax25_bind(): in both cases we increment the refcount, which is ultimately decremented in ax25_release().
Details
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Packages
| Software | From version | Fixed in |
|---|---|---|
| linux | — | 6.8.0-44.44 |
| linux-allwinner-5.19 | — | — |
| linux-aws | — | 6.8.0-1015.16 |
| linux-aws-5.0 | — | — |
| linux-aws-5.11 | — | — |
| linux-aws-5.13 | — | — |
| linux-aws-5.15 | — | 5.15.0-1075.82~20.04.1 |
| linux-aws-5.19 | — | — |
| linux-aws-5.3 | — | — |
| linux-aws-5.4 | — | 5.4.0-1137.147~18.04.1 |
| linux-aws-5.8 | — | — |
| linux-aws-6.2 | — | — |
| linux-aws-6.5 | — | — |
| linux-aws-6.8 | — | 6.8.0-1015.16~22.04.1 |
| linux-aws-fips | — | 5.15.0-1076.83+fips1 |
| linux-aws-hwe | — | 4.15.0-1178.191~16.04.1 |
| linux-azure | — | 6.8.0-1014.16 |
| linux-azure-4.15 | — | 4.15.0-1186.201 |
| linux-azure-5.11 | — | — |
| linux-azure-5.13 | — | — |
| linux-azure-5.15 | — | 5.15.0-1078.87~20.04.1 |
| linux-azure-5.19 | — | — |
| linux-azure-5.3 | — | — |
| linux-azure-5.4 | — | 5.4.0-1142.149~18.04.1 |
| linux-azure-5.8 | — | — |
| linux-azure-6.2 | — | — |
| linux-azure-6.5 | — | — |
| linux-azure-6.8 | — | 6.8.0-1014.16~22.04.1 |
| linux-azure-edge | — | — |
| linux-azure-fde | — | — |
| linux-azure-fde-5.19 | — | — |
| linux-azure-fde-6.2 | — | — |
| linux-azure-fips | — | 5.15.0-1078.87+fips1 |
| linux-bluefield | — | — |
| linux-fips | — | 6.8.0-78.78+fips1 |
| linux-gcp | — | 6.8.0-1014.16 |
| linux-gcp-4.15 | — | 4.15.0-1171.188 |
| linux-gcp-5.11 | — | — |
| linux-gcp-5.13 | — | — |
| linux-gcp-5.15 | — | 5.15.0-1074.83~20.04.1 |
| linux-gcp-5.19 | — | — |
| linux-gcp-5.3 | — | — |
| linux-gcp-5.4 | — | 5.4.0-1141.150~18.04.1 |
| linux-gcp-5.8 | — | — |
| linux-gcp-6.2 | — | — |
| linux-gcp-6.5 | — | — |
| linux-gcp-6.8 | — | 6.8.0-1014.16~22.04.1 |
| linux-gcp-fips | — | 5.15.0-1073.81+fips1 |
| linux-gke | — | 6.8.0-1010.13 |
| linux-gke-4.15 | — | — |
| linux-gke-5.15 | — | — |
| linux-gke-5.4 | — | — |
| linux-gkeop | — | 5.15.0-1057.64 |
| linux-gkeop-5.15 | — | — |
| linux-gkeop-5.4 | — | — |
| linux-hwe | — | — |
| linux-hwe-5.11 | — | — |
| linux-hwe-5.13 | — | — |
| linux-hwe-5.15 | — | 5.15.0-130.140~20.04.1 |
| linux-hwe-5.19 | — | — |
| linux-hwe-5.4 | — | 5.4.0-204.224~18.04.1 |
| linux-hwe-5.8 | — | — |
| linux-hwe-6.2 | — | — |
| linux-hwe-6.5 | — | — |
| linux-hwe-6.8 | — | 6.8.0-45.45~22.04.1 |
| linux-hwe-edge | — | — |
| linux-ibm | — | 6.8.0-1012.12 |
| linux-ibm-5.15 | — | 5.15.0-1067.70~20.04.1 |
| linux-ibm-5.4 | — | 5.4.0-1084.89~18.04.1 |
| linux-ibm-6.8 | — | 6.8.0-1012.12~22.04.1 |
| linux-intel-5.13 | — | — |
| linux-intel-iot-realtime | — | 5.15.0-1071.73 |
| linux-intel-iotg | — | 5.15.0-1071.77 |
| linux-intel-iotg-5.15 | — | 5.15.0-1071.77~20.04.1 |
| linux-iot | — | 5.4.0-1048.51 |
| linux-kvm | — | 5.15.0-1071.76 |
| linux-lowlatency | — | 6.8.0-44.44.1 |
| linux-lowlatency-hwe-5.15 | — | 5.15.0-128.138~20.04.1 |
| linux-lowlatency-hwe-5.19 | — | — |
| linux-lowlatency-hwe-6.2 | — | — |
| linux-lowlatency-hwe-6.5 | — | — |
| linux-lowlatency-hwe-6.8 | — | 6.8.0-44.44.1~22.04.1 |
| linux-lts-xenial | — | 4.4.0-266.300~14.04.1 |
| linux-nvidia | — | 6.8.0-1013.14 |
| linux-nvidia-6.2 | — | — |
| linux-nvidia-6.5 | — | — |
| linux-nvidia-6.8 | — | 6.8.0-1013.14~22.04.1 |
| linux-nvidia-lowlatency | — | 6.8.0-1013.14.1 |
| linux-nvidia-tegra | — | 5.15.0-1032.32 |
| linux-nvidia-tegra-5.15 | — | 5.15.0-1032.32~20.04.1 |
| linux-nvidia-tegra-igx | — | 5.15.0-1020.20 |
| linux-oem | — | — |
| linux-oem-5.10 | — | — |
| linux-oem-5.13 | — | — |
| linux-oem-5.14 | — | — |
| linux-oem-5.17 | — | — |
| linux-oem-5.6 | — | — |
| linux-oem-6.0 | — | — |
| linux-oem-6.1 | — | — |
| linux-oem-6.5 | — | — |
| linux-oem-6.8 | — | 6.8.0-1012.12 |
| linux-oracle | — | 6.8.0-1012.12 |
| linux-oracle-5.0 | — | — |
| linux-oracle-5.11 | — | — |
| linux-oracle-5.13 | — | — |
| linux-oracle-5.15 | — | 5.15.0-1072.78~20.04.1 |
| linux-oracle-5.3 | — | — |
| linux-oracle-5.4 | — | 5.4.0-1136.145~18.04.1 |
| linux-oracle-5.8 | — | — |
| linux-oracle-6.5 | — | — |
| linux-oracle-6.8 | — | 6.8.0-1012.12~22.04.1 |
| linux-raspi | — | 6.8.0-1011.12 |
| linux-raspi-5.4 | — | 5.4.0-1121.133~18.04.1 |
| linux-raspi-realtime | — | 6.8.0-2010.10 |
| linux-raspi2 | — | — |
| linux-realtime | — | 6.8.1-1008.8 |
| linux-realtime-6.8 | — | 6.8.1-1008.8~22.04.1 |
| linux-riscv | — | 6.8.0-44.44.1 |
| linux-riscv-5.11 | — | — |
| linux-riscv-5.15 | — | 5.15.0-1070.74~20.04.1 |
| linux-riscv-5.19 | — | — |
| linux-riscv-5.8 | — | — |
| linux-riscv-6.5 | — | — |
| linux-riscv-6.8 | — | 6.8.0-44.44.1~22.04.1 |
| linux-starfive-5.19 | — | — |
| linux-starfive-6.2 | — | — |
| linux-starfive-6.5 | — | — |
| linux-xilinx-zynqmp | — | 5.15.0-1041.45 |
References
Similar Threats
- Unknown CGA-23jx-hhcx-m389
- Unknown CGA-2qp7-6757-fmgc
- Unknown CGA-2rj5-jc55-r267
- Unknown CGA-3m96-cwq8-6xmx
- Unknown CGA-3qj9-973w-fh9g
Free Vulnerability Check
Is your WordPress site affected?
BotEraser helps you identify potentially vulnerable plugins and themes by checking your installation against known CVE records.
Scan My Site Free →No credit card required · Results in minutes
ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.
