5.5

CVE-2024-26950

wireguard: netlink: access device through ctx instead of peer

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: access device through ctx instead of peer

The previous commit fixed a bug that led to a NULL peer->device being
dereferenced. It's actually easier and faster performance-wise to
instead get the device from ctx->wg. This semantically makes more sense
too, since ctx->wg->peer_allowedips.seq is compared with
ctx->allowedips_seq, basing them both in ctx. This also acts as a
defence in depth provision against freed peers.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.6 < 5.10.215
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.154
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.84
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.24
Linux ≫ Linux Kernel Version >= 6.7 < 6.7.12
Linux ≫ Linux Kernel Version >= 6.8 < 6.8.3
Debian ≫ Debian Linux Version10.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.143
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
Third Party Advisory
Mailing List
https://git.kernel.org/stable/c/09c3fa70f65175861ca948cb2f0f791e666c90e5
Patch
https://git.kernel.org/stable/c/493aa6bdcffd90a4f82aa614fe4f4db0641b4068
Patch
https://git.kernel.org/stable/c/4be453271a882c8ebc28df3dbf9e4d95e6ac42f5
Patch
https://git.kernel.org/stable/c/71cbd32e3db82ea4a74e3ef9aeeaa6971969c86f
Patch
https://git.kernel.org/stable/c/93bcc1752c69bb309f4d8cfaf960ef1faeb34996
Patch
https://git.kernel.org/stable/c/c991567e6c638079304cc15dff28748e4a3c4a37
Patch
https://git.kernel.org/stable/c/d44bd323d8bb8031eef4bdc44547925998a11e47
Patch
https://cert-portal.siemens.com/productcert/html/ssa-265688.html