CVE-2024-56602

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-56602", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-27T14:03:06.011Z", "datePublished": "2024-12-27T14:51:08.174Z", "dateUpdated": "2026-08-05T11:45:22.776Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:22.776Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: do not leave a dangling sk pointer in ieee802154_create()\n\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If ieee802154_create() fails later, the allocated sk object is\nfreed, but the dangling pointer remains in the provided sock object, which\nmay allow use-after-free.\n\nClear the sk pointer in the sock object on error."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is the `socket(AF_IEEE802154, ...)` creation path, reached only through a local syscall via `__sock_create()`; no network- or radio-received data reaches it. Despite the subsystem being a wireless PAN stack, the defect itself is in socket setup, not in frame processing.\nAC:H - The dangling pointer is only produced when `sk->sk_prot->hash()` or `->init()` returns non-zero, but `raw_hash()`, `dgram_hash()` and `dgram_init()` all unconditionally `return 0` in every affected version (2.6.31\u20136.12) and the raw proto has no `.init`, so the error branch is unreachable and the attacker cannot influence it.\nPR:L - Creating a `SOCK_DGRAM` AF_IEEE802154 socket needs no capability at all, so any unprivileged local user reaches `ieee802154_create()`; note the `!net_eq(net, &init_net)` guard means the call must be made in the initial netns, so user namespaces do not lower this further but also are not needed.\nUI:N - The attacker performs the whole sequence with a single `socket()` syscall from its own process. No victim action or interaction is involved.\nS:U - The freed `struct sock`/`struct dgram_sock` and the stale `sock->sk` reference both live entirely within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Per the use-after-free rubric, a stale `sock->sk` reference to a freed `dgram_sock` in the kmalloc-general caches would let an attacker reclaim the slab and read back attacker-shaped or leftover kernel data through subsequent socket operations.\nI:H - The same dangling reference would allow heap spraying of the reclaimed slot, giving control over function-pointer-bearing fields (`sk_prot`, `sk_destruct`, `sk_wq`) and thus a control-flow-hijack primitive rather than a mere data corruption.\nA:H - Any dereference of the freed `sock->sk` would fault or corrupt the socket hash lists, producing an oops or panic; the rubric treats all use-after-free conditions as high availability impact even when only partially exploited."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ieee802154/socket.c"], "versions": [{"version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9", "status": "affected", "versionType": "git"}, {"version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "14959fd7538b3be6d7617d9e60e404d6a8d4fd1f", "status": "affected", "versionType": "git"}, {"version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "2b46994a6e76c8cc5556772932b9b60d03a55cd8", "status": "affected", "versionType": "git"}, {"version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "e8bd6c5f5dc2234b4ea714380aedeea12a781754", "status": "affected", "versionType": "git"}, {"version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "b4982fbf13042e3bb33e04eddfea8b1506b5ea65", "status": "affected", "versionType": "git"}, {"version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "03caa9bfb9fde97fb53d33decd7364514e6825cb", "status": "affected", "versionType": "git"}, {"version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ieee802154/socket.c"], "versions": [{"version": "2.6.31", "status": "affected"}, {"version": "0", "lessThan": "2.6.31", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.287", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.231", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.174", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.120", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.66", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.5", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.4.287"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.10.231"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "5.15.174"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.1.120"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.6.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.12.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.31", "versionEndExcluding": "6.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9"}, {"url": "https://git.kernel.org/stable/c/14959fd7538b3be6d7617d9e60e404d6a8d4fd1f"}, {"url": "https://git.kernel.org/stable/c/2b46994a6e76c8cc5556772932b9b60d03a55cd8"}, {"url": "https://git.kernel.org/stable/c/e8bd6c5f5dc2234b4ea714380aedeea12a781754"}, {"url": "https://git.kernel.org/stable/c/b4982fbf13042e3bb33e04eddfea8b1506b5ea65"}, {"url": "https://git.kernel.org/stable/c/03caa9bfb9fde97fb53d33decd7364514e6825cb"}, {"url": "https://git.kernel.org/stable/c/b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d"}], "title": "net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56602", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-11T15:42:21.145830Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:45:23.837Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:50:43.809Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T20:50:43.809Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-56602", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-11T15:42:21.145830Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T15:42:22.590Z"}}], "cna": {"title": "net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is the `socket(AF_IEEE802154, ...)` creation path, reached only through a local syscall via `__sock_create()`; no network- or radio-received data reaches it. Despite the subsystem being a wireless PAN stack, the defect itself is in socket setup, not in frame processing.\nAC:H - The dangling pointer is only produced when `sk->sk_prot->hash()` or `->init()` returns non-zero, but `raw_hash()`, `dgram_hash()` and `dgram_init()` all unconditionally `return 0` in every affected version (2.6.31\u20136.12) and the raw proto has no `.init`, so the error branch is unreachable and the attacker cannot influence it.\nPR:L - Creating a `SOCK_DGRAM` AF_IEEE802154 socket needs no capability at all, so any unprivileged local user reaches `ieee802154_create()`; note the `!net_eq(net, &init_net)` guard means the call must be made in the initial netns, so user namespaces do not lower this further but also are not needed.\nUI:N - The attacker performs the whole sequence with a single `socket()` syscall from its own process. No victim action or interaction is involved.\nS:U - The freed `struct sock`/`struct dgram_sock` and the stale `sock->sk` reference both live entirely within the kernel's own security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Per the use-after-free rubric, a stale `sock->sk` reference to a freed `dgram_sock` in the kmalloc-general caches would let an attacker reclaim the slab and read back attacker-shaped or leftover kernel data through subsequent socket operations.\nI:H - The same dangling reference would allow heap spraying of the reclaimed slot, giving control over function-pointer-bearing fields (`sk_prot`, `sk_destruct`, `sk_wq`) and thus a control-flow-hijack primitive rather than a mere data corruption.\nA:H - Any dereference of the freed `sock->sk` would fault or corrupt the socket hash lists, producing an oops or panic; the rubric treats all use-after-free conditions as high availability impact even when only partially exploited."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9", "versionType": "git"}, {"status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "14959fd7538b3be6d7617d9e60e404d6a8d4fd1f", "versionType": "git"}, {"status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "2b46994a6e76c8cc5556772932b9b60d03a55cd8", "versionType": "git"}, {"status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "e8bd6c5f5dc2234b4ea714380aedeea12a781754", "versionType": "git"}, {"status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "b4982fbf13042e3bb33e04eddfea8b1506b5ea65", "versionType": "git"}, {"status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "03caa9bfb9fde97fb53d33decd7364514e6825cb", "versionType": "git"}, {"status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "lessThan": "b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d", "versionType": "git"}], "programFiles": ["net/ieee802154/socket.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.31", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.287", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.231", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.174", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.120", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.66", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.5", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ieee802154/socket.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9"}, {"url": "https://git.kernel.org/stable/c/14959fd7538b3be6d7617d9e60e404d6a8d4fd1f"}, {"url": "https://git.kernel.org/stable/c/2b46994a6e76c8cc5556772932b9b60d03a55cd8"}, {"url": "https://git.kernel.org/stable/c/e8bd6c5f5dc2234b4ea714380aedeea12a781754"}, {"url": "https://git.kernel.org/stable/c/b4982fbf13042e3bb33e04eddfea8b1506b5ea65"}, {"url": "https://git.kernel.org/stable/c/03caa9bfb9fde97fb53d33decd7364514e6825cb"}, {"url": "https://git.kernel.org/stable/c/b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: do not leave a dangling sk pointer in ieee802154_create()\n\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If ieee802154_create() fails later, the allocated sk object is\nfreed, but the dangling pointer remains in the provided sock object, which\nmay allow use-after-free.\n\nClear the sk pointer in the sock object on error."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.287", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.231", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.174", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.120", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.66", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.5", "versionStartIncluding": "2.6.31"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13", "versionStartIncluding": "2.6.31"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:45:22.776Z"}}}, "cveMetadata": {"cveId": "CVE-2024-56602", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:45:22.776Z", "dateReserved": "2024-12-27T14:03:06.011Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-12-27T14:51:08.174Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ieee802154/socket.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9", "status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "versionType": "git"}, {"lessThan": "14959fd7538b3be6d7617d9e60e404d6a8d4fd1f", "status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "versionType": "git"}, {"lessThan": "2b46994a6e76c8cc5556772932b9b60d03a55cd8", "status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "versionType": "git"}, {"lessThan": "e8bd6c5f5dc2234b4ea714380aedeea12a781754", "status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "versionType": "git"}, {"lessThan": "b4982fbf13042e3bb33e04eddfea8b1506b5ea65", "status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "versionType": "git"}, {"lessThan": "03caa9bfb9fde97fb53d33decd7364514e6825cb", "status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "versionType": "git"}, {"lessThan": "b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d", "status": "affected", "version": "9ec7671603573ede31207eb5b0b3e1aa211b2854", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ieee802154/socket.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.31"}, {"lessThan": "2.6.31", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.287", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.231", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.174", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.120", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.66", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.13", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DC7D5C80-B677-4131-A399-3366D7F3961C", "versionEndExcluding": "5.4.287", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5C644CC-2BD7-4E32-BC54-8DCC7ABE9935", "versionEndExcluding": "5.10.231", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "419FD073-1517-4FD5-8158-F94BC68A1E89", "versionEndExcluding": "5.15.174", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "09AC6122-E2A4-40FE-9D33-268A1B2EC265", "versionEndExcluding": "6.1.120", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "29A976AD-B9AB-4A95-9F08-7669F8847EB9", "versionEndExcluding": "6.6.66", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9501D045-7A94-42CA-8B03-821BE94A65B7", "versionEndExcluding": "6.12.5", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ieee802154: do not leave a dangling sk pointer in ieee802154_create()\n\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If ieee802154_create() fails later, the allocated sk object is\nfreed, but the dangling pointer remains in the provided sock object, which\nmay allow use-after-free.\n\nClear the sk pointer in the sock object on error."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: ieee802154: no deje un puntero sk colgando en ieee802154_create() sock_init_data() adjunta el objeto sk asignado al objeto sock proporcionado. Si ieee802154_create() falla m\u00e1s tarde, el objeto sk asignado se libera, pero el puntero colgando permanece en el objeto sock proporcionado, lo que puede permitir el use-after-free. Borre el puntero sk en el objeto sock en caso de error."}], "id": "CVE-2024-56602", "lastModified": "2026-08-04T11:22:13.407", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56602", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-11T15:42:21.145830Z", "version": "2.0.3"}}]}, "published": "2024-12-27T15:15:19.650", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/03caa9bfb9fde97fb53d33decd7364514e6825cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/14959fd7538b3be6d7617d9e60e404d6a8d4fd1f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2b46994a6e76c8cc5556772932b9b60d03a55cd8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b4982fbf13042e3bb33e04eddfea8b1506b5ea65"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e8bd6c5f5dc2234b4ea714380aedeea12a781754"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:6966", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}, {"advisory": "RHSA-2025:6966", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-570.12.1.el9_6", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-05-13T00:00:00Z"}], "bugzilla": {"description": "kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()", "id": "2334501", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2334501"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: ieee802154: do not leave a dangling sk pointer in ieee802154_create()\nsock_init_data() attaches the allocated sk object to the provided sock\nobject. If ieee802154_create() fails later, the allocated sk object is\nfreed, but the dangling pointer remains in the provided sock object, which\nmay allow use-after-free.\nClear the sk pointer in the sock object on error.", "A user-after-free vulnerability was found in the linux kernel. sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, leading to a crash and loss of availability of the system."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-56602", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-12-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-56602\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-56602\nhttps://lore.kernel.org/linux-cve-announce/2024122703-CVE-2024-56602-d030@gregkh/T"], "threat_severity": "Moderate"}

{}