We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-49940

l2tp: prevent possible tunnel refcount underflow



AssignerLinux
Reserved2024-10-21
Published2024-10-21
Updated2024-11-05

Description

In the Linux kernel, the following vulnerability has been resolved: l2tp: prevent possible tunnel refcount underflow When a session is created, it sets a backpointer to its tunnel. When the session refcount drops to 0, l2tp_session_free drops the tunnel refcount if session->tunnel is non-NULL. However, session->tunnel is set in l2tp_session_create, before the tunnel refcount is incremented by l2tp_session_register, which leaves a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been bumped. Moving the assignment to l2tp_session_register is trivial but l2tp_session_create calls l2tp_session_set_header_len which uses session->tunnel to get the tunnel's encap. Add an encap arg to l2tp_session_set_header_len to avoid using session->tunnel. If l2tpv3 sessions have colliding IDs, it is possible for l2tp_v3_session_get to race with l2tp_session_register and fetch a session which doesn't yet have session->tunnel set. Add a check for this case.

Product status

Default status
unaffected

1da177e4c3f4 before f7415e60c25a
affected

1da177e4c3f4 before 24256415d186
affected

Default status
affected

6.11.3
unaffected

6.12-rc1
unaffected

References

https://git.kernel.org/stable/c/f7415e60c25a6108cd7955a20b2e66b6251ffe02

https://git.kernel.org/stable/c/24256415d18695b46da06c93135f5b51c548b950

cve.org CVE-2024-49940

nvd.nist.gov CVE-2024-49940

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-49940
Subscribe to our newsletter to learn more about our work.