CVE-2024-41006

What it actually does

Memory leak in nr_heartbeat_expiry() caused by unconditional sock_hold() on sockets with SOCK_DESTROY flag set, preventing proper reference count decrement and socket destruction in NET/ROM protocol handling.

Why it matters to the business

Gradual kernel memory exhaustion on systems using the NET/ROM amateur radio protocol stack, potentially leading to degraded performance or crashes after prolonged operation or repeated socket activity.

How an attack unfolds

An attacker with local access creates and manipulates NET/ROM sockets through nr_connect, nr_release, and state transitions to NR_STATE_2 and NR_STATE_0, triggering nr_heartbeat_expiry() repeatedly to allocate references without corresponding releases.

How to fix it

Update Linux kernel to version 4.19.317 or later, or apply commit d616876256b38ecf9a1a1c7d674192c5346bc69c which restricts sock_hold() to listening sockets only.

How to confirm the fix worked

Verify running kernel version is at or above 4.19.317; inspect /proc/version or kernel build logs for presence of the fix commit; test with syzkaller or similar fuzzing targeting nr_create and heartbeat paths.

Typical attack path

1. Establish NET/ROM socket connection via nr_connect and nr_establish_data_link
2. Trigger nr_release to set SOCK_DESTROY flag while in NR_STATE_3 transitioning to NR_STATE_2
3. Force state machine transitions via nr_rx_frame and nr_state2_machine to NR_STATE_0
4. Allow nr_heartbeat_expiry timer to fire and perform erroneous sock_hold before nr_destroy_socket

How to detect it

Review kernel logs for repeated NET/ROM socket creation and destruction patterns; use slabinfo or kmemleak tools to detect unreleased socket structures; correlate with process activity involving netrom protocol.

What your security team should do

• Prioritize kernel upgrades on all systems exposing NET/ROM interfaces
• Audit custom kernel configurations to disable unused amateur radio protocol modules if not required
• Monitor memory usage trends on affected hosts for unexpected leaks in slab caches related to sockets