# CVE-2024-47711: linux: In the Linux kernel, the following vulnerability has been resolved:  af_unix: Don't return OOB skb in manage_oob()

CVE-2024-47711 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-47711, released October 21, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2024-47711
- Priority: High
- CVSS: 7.8 (high)
- EPSS: 0.0021
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 21, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  af_unix: Don't return OOB skb in manage_oob().  syzbot reported use-after-free in unix_stream_recv_urg(). [0]  The scenario is    1. send(MSG_OOB)   2. recv(MSG_OOB)      -> The consumed OOB remains in recv queue   3. send(MSG_OOB)   4. recv()      -> manage_oob() returns the next skb of the consumed OOB      -> This is also OOB, but unix_sk(sk)->oob_skb is not cleared   5. recv(MSG_OOB)      -> unix_sk(sk)->oob_skb is used but already freed  The recent commit 8594d9b85c07 ("af_unix: Don't call skb_get() for OOB skb.") uncovered the issue.  If the OOB skb is consumed and the next skb is peeked in manage_oob(), we still need to check if the skb is OOB.  Let's do so by falling back to the following checks in manage_oob() and add the test case in selftest.  Note that we need to add a similar check for SIOCATMARK.  [0]: BUG: KASAN: slab-use-after-free in unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959 Read of size 4 at addr ffff8880326abcc4 by task syz-executor178/5235  CPU: 0 UID: 0 PID: 5235 Comm: syz-executor178 Not tainted 6.11.0-rc5-syzkaller-00742-gfbdaffe41adc #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace:  <TASK>  __dump_stack lib/dump_stack.c:93 [inline]  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119  print_address_description mm/kasan/report.c:377 [inline]  print_report+0x169/0x550 mm/kasan/report.c:488  kasan_report+0x143/0x180 mm/kasan/report.c:601  unix_stream_read_actor+0xa6/0xb0 net/unix/af_unix.c:2959  unix_stream_recv_urg+0x1df/0x320 net/unix/af_unix.c:2640  unix_stream_read_generic+0x2456/0x2520 net/unix/af_unix.c:2778  unix_stream_recvmsg+0x22b/0x2c0 net/unix/af_unix.c:2996  sock_recvmsg_nosec net/socket.c:1046 [inline]  sock_recvmsg+0x22f/0x280 net/socket.c:1068  ____sys_recvmsg+0x1db/0x470 net/socket.c:2816  ___sys_recvmsg net/socket.c:2858 [inline]  __sys_recvmsg+0x2f0/0x3e0 net/socket.c:2888  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5360d6b4e9 Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff29b3a458 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 00007fff29b3a638 RCX: 00007f5360d6b4e9 RDX: 0000000000002001 RSI: 0000000020000640 RDI: 0000000000000003 RBP: 00007f5360dde610 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fff29b3a628 R14: 0000000000000001 R15: 0000000000000001  </TASK>  Allocated by task 5235:  kasan_save_stack mm/kasan/common.c:47 [inline]  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68  unpoison_slab_object mm/kasan/common.c:312 [inline]  __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338  kasan_slab_alloc include/linux/kasan.h:201 [inline]  slab_post_alloc_hook mm/slub.c:3988 [inline]  slab_alloc_node mm/slub.c:4037 [inline]  kmem_cache_alloc_node_noprof+0x16b/0x320 mm/slub.c:4080  __alloc_skb+0x1c3/0x440 net/core/skbuff.c:667  alloc_skb include/linux/skbuff.h:1320 [inline]  alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6528  sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2815  sock_alloc_send_skb include/net/sock.h:1778 [inline]  queue_oob+0x108/0x680 net/unix/af_unix.c:2198  unix_stream_sendmsg+0xd24/0xf80 net/unix/af_unix.c:2351  sock_sendmsg_nosec net/socket.c:730 [inline]  __sock_sendmsg+0x221/0x270 net/socket.c:745  ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597  ___sys_sendmsg net/socket.c:2651 [inline]  __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Freed by task 5235:  kasan_save_stack mm/kasan/common.c:47 ---truncated---

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.11.2-1 | [DEBIAN-CVE-2024-47711](https://patchblox.com/security/data/fix/linux/debian-cve-2024-47711.md) | Oct 21, 2024 |
| Linux | linux Debian 14 | 6.11.2-1 | [DEBIAN-CVE-2024-47711](https://patchblox.com/security/data/fix/linux/debian-cve-2024-47711.md) | Oct 21, 2024 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.