Описание
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: Fix potential use-after-free
The skb is delivered to netif_rx() which may free it, after calling this,
dereferencing skb may trigger use-after-free.
A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) networking component. This vulnerability involves a use-after-free error where a network packet's data structure (skb) can be prematurely freed. If the system attempts to access this freed memory, it can lead to a system crash, resulting in a Denial of Service (DoS).
Отчет
This issue is considered to be a moderate impact flaw, as the reproduction for this seems only to cause a DOS.
Меры по смягчению последствий
To mitigate this issue, prevent the hsr kernel module from loading. Create a file named /etc/modprobe.d/blacklist-hsr.conf with the following content:
blacklist hsr
After creating the file, regenerate the initramfs and reboot the system for the changes to take effect:
dracut -f -v
reboot
Disabling the hsr module may impact systems that rely on High-availability Seamless Redundancy networking.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free.
In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free.
In the Linux kernel, the following vulnerability has been resolved: n ...
In the Linux kernel, the following vulnerability has been resolved: net: hsr: Fix potential use-after-free The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free.
Уязвимость функции hsr_deliver_master() ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании или повысить свои привилегии оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации
EPSS
5.5 Medium
CVSS3