7.8

CVE-2024-44986

ipv6: fix possible UAF in ip6_finish_output2()

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible UAF in ip6_finish_output2()

If skb_expand_head() returns NULL, skb has been freed
and associated dst/idev could also have been freed.

We need to hold rcu_read_lock() to make sure the dst and
associated idev are alive.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version 11.0
Linux ≫ Linux Kernel Version >= 5.4.137 < 5.4.289
Linux ≫ Linux Kernel Version >= 5.10.55 < 5.10.233
Linux ≫ Linux Kernel Version >= 5.13.7 < 5.15.166
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.107
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.48
Linux ≫ Linux Kernel Version >= 6.7 < 6.10.7
Linux ≫ Linux Kernel Version 6.11 Update rc1
Linux ≫ Linux Kernel Version 6.11 Update rc2
Linux ≫ Linux Kernel Version 6.11 Update rc3
Linux ≫ Linux Kernel Version 6.11 Update rc4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.71% 0.501
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
416baaa9-dc9f-4396-8d5f-8c081fb06d67 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/3574d28caf9a09756ae87ad1ea096c6f47b6101e
Patch
https://git.kernel.org/stable/c/56efc253196751ece1fc535a5b582be127b0578a
Patch
https://git.kernel.org/stable/c/6ab6bf731354a6fdbaa617d1ec194960db61cf3b
Patch
https://git.kernel.org/stable/c/da273b377ae0d9bd255281ed3c2adb228321687b
Patch
https://git.kernel.org/stable/c/e891b36de161fcd96f12ff83667473e5067b9037
Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Third Party Advisory
Mailing List
https://git.kernel.org/stable/c/1504108cb6020df7b1a31c9bb80fd587470aa448
https://git.kernel.org/stable/c/ae8512e93f4ce47614ca89defaec1b93e00697b8