CVE-2024-56606

What it actually does

Use-after-free in Linux kernel af_packet packet_create() where sock_init_data() attaches an sk object to the sock, but error paths free the sk leaving a dangling pointer that subsequent code can dereference.

Why it matters to the business

Linux systems may experience kernel crashes, memory corruption, or local privilege escalation; low immediate risk given stable low EPSS and no KEV listing, but widespread kernel exposure across distributions requires prompt attention to avoid operational disruption.

How an attack unfolds

An attacker with local access crafts a packet socket creation sequence that forces an error after sock_init_data(), triggering the free of the attached sk and leaving a dangling pointer; later socket operations or concurrent code dereference the freed memory, enabling use-after-free exploitation for memory corruption or code execution. Listed threat actors in 2024 zero-day and Linux kernel campaigns illustrate the general interest in kernel UAF flaws.

How to fix it

Upgrade Linux kernel to commit 71b22837a5e55ac27d6a14b9cdf2326587405c4f or later stable releases; apply distribution-specific updates such as dwarfutils 20120410-2+deb7u2build0.14.04.1 on Ubuntu 14.04 LTS and 20120410-2+deb7u2build0.16.04.1 on Ubuntu 16.04 LTS.

How to confirm the fix worked

Verify running kernel contains commit 71b22837a5e55ac27d6a14b9cdf2326587405c4f or equivalent fixed version via uname and git describe; test packet socket creation under error conditions to confirm absence of dangling pointer.

Typical attack path

1. Obtain local unprivileged access on target Linux system
2. Create AF_PACKET socket and trigger packet_create()
3. Force error condition after sock_init_data() attaches sk
4. Free sk while pointer remains in sock object
5. Trigger subsequent use of dangling pointer via socket APIs or concurrent operations
6. Achieve memory corruption or privilege escalation

How to detect it

Review kernel logs for af_packet related oops, warnings about dangling pointers or use-after-free in packet_create paths; correlate with process activity creating packet sockets. Threat actor context from espionage and financial campaigns can guide hunting for anomalous local socket usage preceding kernel faults.

What your security team should do

• Prioritize kernel upgrades to the listed fixed commits within standard patch windows given low EPSS
• Monitor for kernel oops or use-after-free reports involving af_packet
• Restrict unprivileged use of AF_PACKET sockets via capabilities or seccomp where feasible
• Review downstream dependents of affected kernel trees for coordinated updates