In the Linux kernel, the following vulnerability has been resolved:
s390/iucv: MSGPEEK causes memory leak in iucvsock_destruct()
Passing MSGPEEK flag to skbrecvdatagram() increments skb refcount (skb->users) and iucvsockrecvmsg() does not decrement skb refcount at exit. This results in skb memory leak in skbqueuepurge() and WARNON in iucvsockdestruct() during socket close. To fix this decrease skb refcount by one if MSGPEEK is set in order to prevent memory leak and WARNON.
WARNING: CPU: 2 PID: 6292 at net/iucv/afiucv.c:286 iucvsockdestruct+0x144/0x1a0 [afiucv] CPU: 2 PID: 6292 Comm: afiucvtestmsg Kdump: loaded Tainted: G W 6.10.0-rc7 #1 Hardware name: IBM 3931 A01 704 (z/VM 7.3.0) Call Trace: [<001587c682c4aa98>] iucvsockdestruct+0x148/0x1a0 [afiucv] [<001587c682c4a9d0>] iucvsockdestruct+0x80/0x1a0 [afiucv] [<001587c704117a32>] _skdestruct+0x52/0x550 [<001587c704104a54>] _sockrelease+0xa4/0x230 [<001587c704104c0c>] sockclose+0x2c/0x40 [<001587c702c5f5a8>] _fput+0x2e8/0x970 [<001587c7024148c4>] taskworkrun+0x1c4/0x2c0 [<001587c7023b0716>] doexit+0x996/0x1050 [<001587c7023b13aa>] dogroupexit+0x13a/0x360 [<001587c7023b1626>] _s390xsysexitgroup+0x56/0x60 [<001587c7022bccca>] dosyscall+0x27a/0x380 [<001587c7049a6a0c>] _dosyscall+0x9c/0x160 [<001587c7049ce8a8>] systemcall+0x70/0x98 Last Breaking-Event-Address: [<001587c682c4a9d4>] iucvsockdestruct+0x84/0x1a0 [afiucv]
[
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"259473572367793395387592543960451828272",
"261228473481322398334189998657550053177",
"313217983473366906620510906060547389228",
"133491246282409414577358044115296870208",
"59921704319395002428552645552054412977",
"200757545200158183979826124535770934422",
"112918045064534213846929146439637369991",
"312394165127597017530123989285618141525",
"282179486329135045486663322195223046004",
"100838559002248787376489363007737117877",
"203469430555245633649817653516381471813",
"323422835689413620394875962056261097300",
"136115006652710675408525796578563909321",
"159085196514905413177758776122523046480",
"222340358665108750081817227451601932219",
"40156041397288002451985343780912936389",
"182790293399553164757701906104681148432",
"195240686695877670983091447916545504059",
"116580410742479776719676991830065370300",
"253288281356258934529775312946782639502",
"95775443195641751233749818561267364553",
"307879813110120276013826961720932611718"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f603e66e1c59c1d25e60eb0636cb307d190782e",
"target": {
"file": "net/iucv/af_iucv.c"
},
"id": "CVE-2024-53210-031feea4"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"259473572367793395387592543960451828272",
"261228473481322398334189998657550053177",
"313217983473366906620510906060547389228",
"133491246282409414577358044115296870208",
"59921704319395002428552645552054412977",
"200757545200158183979826124535770934422",
"112918045064534213846929146439637369991",
"312394165127597017530123989285618141525",
"282179486329135045486663322195223046004",
"100838559002248787376489363007737117877",
"203469430555245633649817653516381471813",
"323422835689413620394875962056261097300",
"136115006652710675408525796578563909321",
"159085196514905413177758776122523046480",
"222340358665108750081817227451601932219",
"40156041397288002451985343780912936389",
"182790293399553164757701906104681148432",
"195240686695877670983091447916545504059",
"116580410742479776719676991830065370300",
"253288281356258934529775312946782639502",
"95775443195641751233749818561267364553",
"307879813110120276013826961720932611718"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebaf81317e42aa990ad20b113cfe3a7b20d4e937",
"target": {
"file": "net/iucv/af_iucv.c"
},
"id": "CVE-2024-53210-399b8fa8"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2397.0,
"function_hash": "293292820108564979931416851197901480559"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42251c2d1ef1cb0822638bebb87ad9120c759673",
"target": {
"file": "net/iucv/af_iucv.c",
"function": "iucv_sock_recvmsg"
},
"id": "CVE-2024-53210-600d370f"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2397.0,
"function_hash": "293292820108564979931416851197901480559"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@934326aef7ac4652f81c69d18bf44eebaefc39c3",
"target": {
"file": "net/iucv/af_iucv.c",
"function": "iucv_sock_recvmsg"
},
"id": "CVE-2024-53210-81c9ad99"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2397.0,
"function_hash": "293292820108564979931416851197901480559"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f603e66e1c59c1d25e60eb0636cb307d190782e",
"target": {
"file": "net/iucv/af_iucv.c",
"function": "iucv_sock_recvmsg"
},
"id": "CVE-2024-53210-84b53bd1"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"259473572367793395387592543960451828272",
"261228473481322398334189998657550053177",
"313217983473366906620510906060547389228",
"133491246282409414577358044115296870208",
"59921704319395002428552645552054412977",
"200757545200158183979826124535770934422",
"112918045064534213846929146439637369991",
"312394165127597017530123989285618141525",
"282179486329135045486663322195223046004",
"100838559002248787376489363007737117877",
"203469430555245633649817653516381471813",
"323422835689413620394875962056261097300",
"136115006652710675408525796578563909321",
"159085196514905413177758776122523046480",
"222340358665108750081817227451601932219",
"40156041397288002451985343780912936389",
"182790293399553164757701906104681148432",
"195240686695877670983091447916545504059",
"116580410742479776719676991830065370300",
"253288281356258934529775312946782639502",
"95775443195641751233749818561267364553",
"307879813110120276013826961720932611718"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42251c2d1ef1cb0822638bebb87ad9120c759673",
"target": {
"file": "net/iucv/af_iucv.c"
},
"id": "CVE-2024-53210-8ea17344"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"259473572367793395387592543960451828272",
"261228473481322398334189998657550053177",
"313217983473366906620510906060547389228",
"133491246282409414577358044115296870208",
"59921704319395002428552645552054412977",
"200757545200158183979826124535770934422",
"112918045064534213846929146439637369991",
"312394165127597017530123989285618141525",
"282179486329135045486663322195223046004",
"100838559002248787376489363007737117877",
"203469430555245633649817653516381471813",
"323422835689413620394875962056261097300",
"136115006652710675408525796578563909321",
"159085196514905413177758776122523046480",
"222340358665108750081817227451601932219",
"40156041397288002451985343780912936389",
"182790293399553164757701906104681148432",
"195240686695877670983091447916545504059",
"116580410742479776719676991830065370300",
"253288281356258934529775312946782639502",
"95775443195641751233749818561267364553",
"307879813110120276013826961720932611718"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@934326aef7ac4652f81c69d18bf44eebaefc39c3",
"target": {
"file": "net/iucv/af_iucv.c"
},
"id": "CVE-2024-53210-9ba06c5a"
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"line_hashes": [
"259473572367793395387592543960451828272",
"261228473481322398334189998657550053177",
"313217983473366906620510906060547389228",
"133491246282409414577358044115296870208",
"59921704319395002428552645552054412977",
"200757545200158183979826124535770934422",
"112918045064534213846929146439637369991",
"312394165127597017530123989285618141525",
"282179486329135045486663322195223046004",
"100838559002248787376489363007737117877",
"203469430555245633649817653516381471813",
"323422835689413620394875962056261097300",
"136115006652710675408525796578563909321",
"159085196514905413177758776122523046480",
"222340358665108750081817227451601932219",
"40156041397288002451985343780912936389",
"182790293399553164757701906104681148432",
"195240686695877670983091447916545504059",
"116580410742479776719676991830065370300",
"253288281356258934529775312946782639502",
"95775443195641751233749818561267364553",
"307879813110120276013826961720932611718"
],
"threshold": 0.9
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@783c2c6e61c5a04eb8baea598753d5fa174dbe85",
"target": {
"file": "net/iucv/af_iucv.c"
},
"id": "CVE-2024-53210-df0f41f3"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2397.0,
"function_hash": "293292820108564979931416851197901480559"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebaf81317e42aa990ad20b113cfe3a7b20d4e937",
"target": {
"file": "net/iucv/af_iucv.c",
"function": "iucv_sock_recvmsg"
},
"id": "CVE-2024-53210-ee302f74"
},
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 2397.0,
"function_hash": "293292820108564979931416851197901480559"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@783c2c6e61c5a04eb8baea598753d5fa174dbe85",
"target": {
"file": "net/iucv/af_iucv.c",
"function": "iucv_sock_recvmsg"
},
"id": "CVE-2024-53210-f57879bd"
}
]