5.5

CVE-2024-44944

netfilter: ctnetlink: use helper function to calculate expect ID

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ctnetlink: use helper function to calculate expect ID

Delete expectation path is missing a call to the nf_expect_get_id()
helper function to calculate the expectation ID, otherwise LSB of the
expectation object address is leaked to userspace.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.2 < 5.4.282
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.224
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.165
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.103
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.44
Linux ≫ Linux Kernel Version >= 6.7 < 6.10.3
Linux ≫ Linux Kernel Version4.19.320
Linux ≫ Linux Kernel Version5.1
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.147
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

https://git.kernel.org/stable/c/24f407042cf90b0872de667460230d8d50c06c39
Patch
https://git.kernel.org/stable/c/27662b46f2adaa52c1665a82af4b21c42c4337fd
Patch
https://git.kernel.org/stable/c/5e2c24f7b0911b15c29aefce760bcf770542fb61
Patch
https://git.kernel.org/stable/c/64c0b8e64be8368617ef08dfc59a3160563a1435
Patch
https://git.kernel.org/stable/c/66e7650dbbb8e236e781c670b167edc81e771450
Patch
https://git.kernel.org/stable/c/74de442b8e12a207c07953ee068009a7701aff8f
Patch
https://git.kernel.org/stable/c/782161895eb4ac45cf7cfa8db375bd4766cb8299
Patch
https://git.kernel.org/stable/c/eb4ca1a97e08ff5b920664ba292e576257e2d184
Patch
https://www.zerodayinitiative.com/advisories/ZDI-24-1182/
https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
https://cert-portal.siemens.com/productcert/html/ssa-355557.html
https://cert-portal.siemens.com/productcert/html/ssa-613116.html