7.8

CVE-2024-44986

ipv6: fix possible UAF in ip6_finish_output2()

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible UAF in ip6_finish_output2()

If skb_expand_head() returns NULL, skb has been freed
and associated dst/idev could also have been freed.

We need to hold rcu_read_lock() to make sure the dst and
associated idev are alive.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version11.0
Linux ≫ Linux Kernel Version >= 5.4.137 < 5.4.289
Linux ≫ Linux Kernel Version >= 5.10.55 < 5.10.233
Linux ≫ Linux Kernel Version >= 5.13.7 < 5.15.166
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.107
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.48
Linux ≫ Linux Kernel Version >= 6.7 < 6.10.7
Linux ≫ Linux Kernel Version6.11 Updaterc1
Linux ≫ Linux Kernel Version6.11 Updaterc2
Linux ≫ Linux Kernel Version6.11 Updaterc3
Linux ≫ Linux Kernel Version6.11 Updaterc4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.144
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/3574d28caf9a09756ae87ad1ea096c6f47b6101e
Patch
https://git.kernel.org/stable/c/56efc253196751ece1fc535a5b582be127b0578a
Patch
https://git.kernel.org/stable/c/6ab6bf731354a6fdbaa617d1ec194960db61cf3b
Patch
https://git.kernel.org/stable/c/da273b377ae0d9bd255281ed3c2adb228321687b
Patch
https://git.kernel.org/stable/c/e891b36de161fcd96f12ff83667473e5067b9037
Patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Third Party Advisory
Mailing List