exploitDog

CVE-2024-26641

Опубликовано: 18 мар. 2024

Источник: nvd

CVSS3: 5.5

EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()

syzbot found __ip6_tnl_rcv() could access unitiliazed data [1].

Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head.

[1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727 __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845 ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888 gre_rcv+0x143f/0x1870 ip6_protocol_deliver_rcu+0xda6/0x2a60 net

Ссылки

https://git.kernel.org/stable/c/350a6640fac4b53564ec20aa3f4a0922cb0ba5e6
Mailing List
Patch
https://git.kernel.org/stable/c/8d975c15c0cd744000ca386247432d57b21f9df0
Mailing List
Patch
https://git.kernel.org/stable/c/a9bc32879a08f23cdb80a48c738017e39aea1080
Mailing List
Patch
https://git.kernel.org/stable/c/af6b5c50d47ab43e5272ad61935d0ed2e264d3f0
Mailing List
Patch
https://git.kernel.org/stable/c/c835df3bcc14858ae9b27315dd7de76370b94f3a
Mailing List
Patch
https://git.kernel.org/stable/c/d54e4da98bbfa8c257bdca94c49652d81d18a4d8
Mailing List
Patch
https://git.kernel.org/stable/c/350a6640fac4b53564ec20aa3f4a0922cb0ba5e6
Mailing List
Patch
https://git.kernel.org/stable/c/8d975c15c0cd744000ca386247432d57b21f9df0
Mailing List
Patch
https://git.kernel.org/stable/c/a9bc32879a08f23cdb80a48c738017e39aea1080
Mailing List
Patch
https://git.kernel.org/stable/c/af6b5c50d47ab43e5272ad61935d0ed2e264d3f0
Mailing List
Patch
https://git.kernel.org/stable/c/c835df3bcc14858ae9b27315dd7de76370b94f3a
Mailing List
Patch
https://git.kernel.org/stable/c/d54e4da98bbfa8c257bdca94c49652d81d18a4d8
Mailing List
Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
Mailing List
https://security.netapp.com/advisory/ntap-20241108-0008/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.7 (включая) до 5.10.210 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.11 (включая) до 5.15.149 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.16 (включая) до 6.1.77 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.2 (включая) до 6.6.16 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.7 (включая) до 6.7.4 (исключая)

cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*

cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:a800:*:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:netapp:c800_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:c800:*:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:netapp:a900_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:a900:*:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:netapp:fas9500_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:fas9500:*:*:*:*:*:*:*:*

Конфигурация 8

Одновременно

cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:c190:*:*:*:*:*:*:*:*

Конфигурация 9

Одновременно

cpe:2.3:o:netapp:a150_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:a150:*:*:*:*:*:*:*:*

Конфигурация 10

Одновременно

cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:a220:*:*:*:*:*:*:*:*

Конфигурация 11

Одновременно

cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:fas2720:*:*:*:*:*:*:*:*

Конфигурация 12

Одновременно

cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:fas2750:*:*:*:*:*:*:*:*

Конфигурация 13

Одновременно

cpe:2.3:o:netapp:fas2820_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:fas2820:*:*:*:*:*:*:*:*

EPSS

Процентиль: 2%

0.00016

Низкий

5.5 Medium

CVSS3

Дефекты

CWE-908

Связанные уязвимости

CVE-2024-26641

CVSS3: 5.5

ubuntu

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head. [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727 __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845 ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888 gre_rcv+0x143f/0x1870 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:4...

CVE-2024-26641

CVSS3: 5.5

redhat

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head. [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727 __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845 ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888 gre_rcv+0x143f/0x1870 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:4...

CVE-2024-26641

CVSS3: 5.5

debian

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: i ...

GHSA-3pmw-h7mc-vxxq

CVSS3: 5.5

github

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head. [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7df/0x1e50 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x178/0x1b0 net/ipv6/ip6_tunnel.c:727 __ip6_tnl_rcv+0xd4e/0x1590 net/ipv6/ip6_tunnel.c:845 ip6_tnl_rcv+0xce/0x100 net/ipv6/ip6_tunnel.c:888 gre_rcv+0x143f/0x1870 ip6_protocol_deliver_rcu+0xda6/0x2a60 ...

BDU:2024-03651

CVSS3: 9.1

fstec

больше 1 года назад

Уязвимость функции __ip6_tnl_rcv() в модуле net/ipv6/ip6_tunnel.c реализации протокола IPv6 ядра операционной системы Linux, позволяющая нарушителю раскрыть защищаемую информацию или вызвать отказ в обслуживании

EPSS

Процентиль: 2%

0.00016

Низкий

5.5 Medium

CVSS3

Дефекты

CWE-908