CVE-2024-40954: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-40954 is a vulnerability in the Linux kernel that involves a use-after-free condition in the networking subsystem. The issue occurs when a socket creation fails, leaving a dangling socket pointer that can be exploited under specific conditions. This vulnerability was discovered in July 2024 and affects Linux kernel versions from 5.12 up to versions before 5.15.162, 6.1.96, 6.6.36, and 6.9.7 (NVD).

The vulnerability can be triggered by attaching an fentry probe to __sock_release() and calling the bpf_get_socket_cookie() helper while running traceroute -I 1.1.1.1 on a freshly booted VM. The issue stems from a failure to properly clear the struct socket reference in sk_common_release(), which should cover all protocol families create functions that may have already attached the reference to the sk object with sock_init_data(). The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability can lead to a use-after-free condition in the Linux kernel, potentially allowing an attacker to execute arbitrary code, cause denial of service, or gain elevated privileges. The vulnerability affects the kernel's networking stack and can be triggered through specific networking operations (NVD).

The vulnerability requires local access and can be triggered through a specific sequence of operations involving BPF programs and networking tools. A proof-of-concept exists that demonstrates the vulnerability using traceroute with ICMP packets and an fentry probe (Kernel Patch).

The vulnerability has been fixed in the Linux kernel through a patch that clears the struct socket reference in sk_common_release(). The fix has been backported to multiple stable kernel versions. Users should update to Linux kernel versions 5.15.162, 6.1.96, 6.6.36, 6.9.7 or later to mitigate this vulnerability (Kernel Patch).