7.8

CVE-2024-44985

ipv6: prevent possible UAF in ip6_xmit()

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent possible UAF in ip6_xmit()

If skb_expand_head() returns NULL, skb has been freed
and the associated dst/idev could also have been freed.

We must use rcu_read_lock() to prevent a possible UAF.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.15 < 5.15.166
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.107
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.48
Linux ≫ Linux Kernel Version >= 6.7 < 6.10.7
Linux ≫ Linux Kernel Version6.11 Updaterc1
Linux ≫ Linux Kernel Version6.11 Updaterc2
Linux ≫ Linux Kernel Version6.11 Updaterc3
Linux ≫ Linux Kernel Version6.11 Updaterc4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.25% 0.162
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/124b428fe28064c809e4237b0b38e97200a8a4a8
Patch
https://git.kernel.org/stable/c/2d5ff7e339d04622d8282661df36151906d0e1c7
Patch
https://git.kernel.org/stable/c/38a21c026ed2cc7232414cb166efc1923f34af17
Patch
https://git.kernel.org/stable/c/975f764e96f71616b530e300c1bb2ac0ce0c2596
Patch
https://git.kernel.org/stable/c/b3a3d5333c13a1be57499581eab4a8fc94d57f36
https://git.kernel.org/stable/c/c47e022011719fc5727bca661d662303180535ba
https://git.kernel.org/stable/c/fc88d6c1f2895a5775795d82ec581afdff7661d1
Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html