CVE-2024-56602

What it actually does

Failure to clear a dangling sk pointer in the sock object after an error path in ieee802154_create() following sock_init_data() enables a use-after-free condition on the freed sk object.

Why it matters to the business

Organizations running affected Linux kernels face elevated risk of local privilege escalation or system instability in environments using IEEE 802.15.4 networking, potentially leading to unauthorized access or service disruption until kernels are updated.

How an attack unfolds

An attacker with local access triggers the error path in ieee802154_create() after the socket has been partially initialized, then reuses the freed sk object through the still-referenced dangling pointer to achieve arbitrary code execution or information disclosure.

How to fix it

Apply the upstream fix by updating to a kernel containing commit 1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9 or later stable releases that include the change; rebuild and deploy updated kernel packages across all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 1d5fe782c0ff068d80933f9cfd0fd39d5434bbc9 via git log or package version checks; attempt socket creation under error conditions in a test environment to confirm absence of the dangling pointer.

Typical attack path

1. Obtain local code execution on a system running a vulnerable kernel build
2. Create an AF_IEEE802154 socket to invoke ieee802154_create()
3. Force the function to fail after sock_init_data() has attached the sk object
4. Reuse the dangling pointer in the sock object to access the now-freed sk structure
5. Leverage the use-after-free for privilege escalation or kernel memory manipulation

How to detect it

Review kernel crash logs and oops reports for ieee802154-related use-after-free signatures; inspect audit logs for unexpected socket creation failures followed by privilege changes or memory corruption indicators.

What your security team should do

• Prioritize kernel updates on systems exposing IEEE 802.15.4 interfaces or running untrusted workloads
• Monitor vendor advisories for distribution-specific backports of the referenced commit
• Restrict unprivileged local access where feasible until patches are applied
• Include the fixed commit hash in automated kernel version scanning rules