Executive Summary

This vulnerability exists in the Linux kernel's CAIF network subsystem. Specifically, when a client connection is torn down using the caif_connect() function, it calls caif_disconnect_client() and then caif_free_client(). The caif_free_client() function releases the service layer referenced by adap_layer->dn but leaves the pointer stale (dangling). Later, when the socket is destroyed, caif_sock_destructor() calls caif_free_client() again and attempts to dereference this already freed service pointer, which can lead to undefined behavior or crashes.

The fix involves clearing the client/service pointers before releasing the service object, making repeated teardown operations safe and preventing the use of stale pointers.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel to dereference a freed pointer during socket destruction, potentially leading to kernel crashes or system instability. Such behavior can be exploited to cause denial of service by crashing the system or disrupting network communications.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved in the Linux kernel by clearing the client/service pointers before releasing the service object to prevent stale pointer dereferences.

To mitigate this vulnerability immediately, you should update your Linux kernel to the fixed version that includes this patch.

Useful 0 Not Useful 0