Описание
In the Linux kernel, the following vulnerability has been resolved:
batman-adv: gw: acquire ethernet header only after skb realloc
The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer
behind the skb. Variables which were pointing to the old buffer need to be
reassigned to avoid an use-after-free.
A flaw was found in the batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) module of the Linux kernel. When the pskb_may_pull() function is called by batadv_get_vid(), it can reallocate the buffer, causing variables to point to a freed memory region. This use-after-free vulnerability could allow a local attacker to cause a denial of service or potentially execute arbitrary code.
Отчет
A moderate-severity use-after-free flaw was found in the Linux kernel's batman-adv (Better Approach To Mobile Ad-hoc Networking - Advanced) gateway handling code. When processing packets on a system using the batman-adv mesh protocol, the pskb_may_pull() call made by batadv_get_vid() can reallocate the buffer behind the skb, leaving pointers that were acquired before the reallocation referencing freed memory. This use-after-free is most likely to cause a kernel crash and denial of service; the upstream description also notes the theoretical potential for arbitrary code execution, although reliably exploiting a kernel use-after-free requires significant effort and precise timing. Red Hat Product Security rates this flaw as Moderate severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), reflecting a local attack vector with availability-only impact, which is substantially lower than the CVEORG score of 8.8 (Important, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel and kernel-rt streams are not affected by this flaw because the vulnerable code is not present in the shipped kernel builds.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Not affected | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.
In the Linux kernel, the following vulnerability has been resolved: batman-adv: gw: acquire ethernet header only after skb realloc The pskb_may_pull() called by batadv_get_vid() could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an use-after-free.
In the Linux kernel, the following vulnerability has been resolved: b ...
EPSS
5.5 Medium
CVSS3