CVE-2024-56688 sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
A null pointer dereference in the Linux kernel's sunrpc module can cause a system crash when resetting network transports.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-56688?
CVE-2024-56688 is a high-severity vulnerability in Linux kernel, published on 28 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
Since transport->sock has been set to NULL during reset transport, XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the xs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request() to dereference the transport->sock that has been set to NULL.
Weakness: CWE-476
Which versions are affected by CVE-2024-56688?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-56688?
Apply the vendor's patch.
Is CVE-2024-56688 being exploited?
There is no known exploitation of CVE-2024-56688 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-55166, AZL-55196, BELL-CVE-2024-56688, DEBIAN-CVE-2024-56688, GHSA-v859-83xr-7x5w, UBUNTU-CVE-2024-56688.