Описание
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: frag: free unfragmentable packet
The caller of batadv_frag_send_packet() assume that the skb provided to the
function are always consumed. But the pre-check for an empty payload or the
zero fragment size returned an error without any further actions.
A failed pre-check must use the same error handling code as the rest of the
function.
A flaw was found in the batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) fragmentation module of the Linux kernel. The batadv_frag_send_packet() function, responsible for sending fragmented packets, does not properly free allocated memory when a packet is deemed unfragmentable due to an empty payload or zero fragment size. This oversight can lead to a memory leak, potentially affecting system stability and performance.
Отчет
A memory leak flaw was found in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) packet fragmentation code. When batadv_frag_send_packet() rejected a packet as unfragmentable because of an empty payload or a zero fragment size, it returned an error without freeing the associated socket buffer (skb), even though callers of the function assume the skb is always consumed. Repeatedly triggering this error path leaks kernel memory, which can degrade system stability and performance and ultimately lead to a denial of service through memory exhaustion. Red Hat rated this flaw Moderate (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), affecting only availability, because exploiting it requires the ability to locally originate the malformed batman-adv traffic that reaches the flawed error path. The vulnerable code is not present in the Red Hat Enterprise Linux kernels (including kernel-rt) or in the Red Hat In-Vehicle OS kernels (kernel and kernel-ivos-qualcomm) covered by this flaw, so all Red Hat products tracked for this issue are marked not affected.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadv_frag_send_packet() assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an error without any further actions. A failed pre-check must use the same error handling code as the rest of the function.
In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadv_frag_send_packet() assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an error without any further actions. A failed pre-check must use the same error handling code as the rest of the function.
In the Linux kernel, the following vulnerability has been resolved: b ...
EPSS
5.5 Medium
CVSS3