cvelistv5 - cve-2024-26633

cve-2024-26633

Vulnerability from cvelistv5

Published

2024-03-18 10:07

Modified

2025-05-04 12:54

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage. [1] BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 __pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendms ---truncated---

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/135414f300c5db995e2a2f3bf0f455de9d014aee	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3f15ba3dc14e6ee002ea01b4faddc3d49200377c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/4329426cf6b8e22b798db2331c7ef1dd2a9c748d	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/62a1fedeb14c7ac0947ef33fadbabd35ed2400a2	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/687c5d52fe53e602e76826dbd4d7af412747e183	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ba8d904c274268b18ef3dc11d3ca7b24a96cb087	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/135414f300c5db995e2a2f3bf0f455de9d014aee	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/3f15ba3dc14e6ee002ea01b4faddc3d49200377c	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/4329426cf6b8e22b798db2331c7ef1dd2a9c748d	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/62a1fedeb14c7ac0947ef33fadbabd35ed2400a2	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/687c5d52fe53e602e76826dbd4d7af412747e183	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/ba8d904c274268b18ef3dc11d3ca7b24a96cb087	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198	Patch
af854a3a-2127-422b-91ae-364da2661108	https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd	Patch
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20241220-0001/	Third Party Advisory

Impacted products

Vendor

Product

Version

▼

Linux

Version: fbfa743a9d2a0ffa24251764f10afc13eb21e739
Version: fbfa743a9d2a0ffa24251764f10afc13eb21e739
Version: fbfa743a9d2a0ffa24251764f10afc13eb21e739
Version: fbfa743a9d2a0ffa24251764f10afc13eb21e739
Version: fbfa743a9d2a0ffa24251764f10afc13eb21e739
Version: fbfa743a9d2a0ffa24251764f10afc13eb21e739
Version: fbfa743a9d2a0ffa24251764f10afc13eb21e739
Version: fbfa743a9d2a0ffa24251764f10afc13eb21e739
Version: a6f6bb6bc04a5f88a31f47a6123d3fbf5ee8d694
Version: 72bbf335e7aad09c88c50dbdd238f4faabd12174
Version: decccc92ee0a978a1c268b5df16824cb6384ed3c
Version: d3d9b59ab32160e3cc4edcf7e5fa7cecb53a7d25
Version: d397f7035d2c754781bbe93b07b94d8cd898620c
Version: 41e07a7e01d951cfd4c9a7dac90c921269d89513
Version: a7fe4e5d06338e1a82b1977eca37400951f99730

Linux

Version: 4.10

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-26633",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-18T19:01:45.822242Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-05T17:13:27.539Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-12-20T13:06:42.426Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/135414f300c5db995e2a2f3bf0f455de9d014aee"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3f15ba3dc14e6ee002ea01b4faddc3d49200377c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4329426cf6b8e22b798db2331c7ef1dd2a9c748d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/62a1fedeb14c7ac0947ef33fadbabd35ed2400a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/687c5d52fe53e602e76826dbd4d7af412747e183"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ba8d904c274268b18ef3dc11d3ca7b24a96cb087"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20241220-0001/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "135414f300c5db995e2a2f3bf0f455de9d014aee",
              "status": "affected",
              "version": "fbfa743a9d2a0ffa24251764f10afc13eb21e739",
              "versionType": "git"
            },
            {
              "lessThan": "3f15ba3dc14e6ee002ea01b4faddc3d49200377c",
              "status": "affected",
              "version": "fbfa743a9d2a0ffa24251764f10afc13eb21e739",
              "versionType": "git"
            },
            {
              "lessThan": "da23bd709b46168f7dfc36055801011222b076cd",
              "status": "affected",
              "version": "fbfa743a9d2a0ffa24251764f10afc13eb21e739",
              "versionType": "git"
            },
            {
              "lessThan": "4329426cf6b8e22b798db2331c7ef1dd2a9c748d",
              "status": "affected",
              "version": "fbfa743a9d2a0ffa24251764f10afc13eb21e739",
              "versionType": "git"
            },
            {
              "lessThan": "62a1fedeb14c7ac0947ef33fadbabd35ed2400a2",
              "status": "affected",
              "version": "fbfa743a9d2a0ffa24251764f10afc13eb21e739",
              "versionType": "git"
            },
            {
              "lessThan": "687c5d52fe53e602e76826dbd4d7af412747e183",
              "status": "affected",
              "version": "fbfa743a9d2a0ffa24251764f10afc13eb21e739",
              "versionType": "git"
            },
            {
              "lessThan": "ba8d904c274268b18ef3dc11d3ca7b24a96cb087",
              "status": "affected",
              "version": "fbfa743a9d2a0ffa24251764f10afc13eb21e739",
              "versionType": "git"
            },
            {
              "lessThan": "d375b98e0248980681e5e56b712026174d617198",
              "status": "affected",
              "version": "fbfa743a9d2a0ffa24251764f10afc13eb21e739",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a6f6bb6bc04a5f88a31f47a6123d3fbf5ee8d694",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "72bbf335e7aad09c88c50dbdd238f4faabd12174",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "decccc92ee0a978a1c268b5df16824cb6384ed3c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d3d9b59ab32160e3cc4edcf7e5fa7cecb53a7d25",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d397f7035d2c754781bbe93b07b94d8cd898620c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "41e07a7e01d951cfd4c9a7dac90c921269d89513",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a7fe4e5d06338e1a82b1977eca37400951f99730",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/ip6_tunnel.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.306",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.268",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.306",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.268",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.209",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.148",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.75",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.2.87",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.10.106",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.12.71",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.42",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.49",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.50",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\n\nsyzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.\n\nReading frag_off can only be done if we pulled enough bytes\nto skb-\u003ehead. Currently we might access garbage.\n\n[1]\nBUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendmsg net/socket.c:2676 [inline]\n__se_sys_sendmsg net/socket.c:2674 [inline]\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\ndo_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\n\nUninit was created at:\nslab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\nslab_alloc_node mm/slub.c:3478 [inline]\n__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\n__do_kmalloc_node mm/slab_common.c:1006 [inline]\n__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027\nkmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\npskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098\n__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655\npskb_may_pull_reason include/linux/skbuff.h:2673 [inline]\npskb_may_pull include/linux/skbuff.h:2681 [inline]\nip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\nxmit_one net/core/dev.c:3548 [inline]\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\nneigh_output include/net/neighbour.h:542 [inline]\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\ndst_output include/net/dst.h:451 [inline]\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\nsock_sendmsg_nosec net/socket.c:730 [inline]\n__sock_sendmsg net/socket.c:745 [inline]\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\n__sys_sendmsg net/socket.c:2667 [inline]\n__do_sys_sendms\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:54:18.313Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/135414f300c5db995e2a2f3bf0f455de9d014aee"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f15ba3dc14e6ee002ea01b4faddc3d49200377c"
        },
        {
          "url": "https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/4329426cf6b8e22b798db2331c7ef1dd2a9c748d"
        },
        {
          "url": "https://git.kernel.org/stable/c/62a1fedeb14c7ac0947ef33fadbabd35ed2400a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/687c5d52fe53e602e76826dbd4d7af412747e183"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba8d904c274268b18ef3dc11d3ca7b24a96cb087"
        },
        {
          "url": "https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198"
        }
      ],
      "title": "ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26633",
    "datePublished": "2024-03-18T10:07:49.468Z",
    "dateReserved": "2024-02-19T14:20:24.136Z",
    "dateUpdated": "2025-05-04T12:54:18.313Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26633\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-18T11:15:09.867\",\"lastModified\":\"2025-04-04T14:49:01.373\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\\n\\nsyzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.\\n\\nReading frag_off can only be done if we pulled enough bytes\\nto skb-\u003ehead. Currently we might access garbage.\\n\\n[1]\\nBUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\\nip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\\nxmit_one net/core/dev.c:3548 [inline]\\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\\nneigh_output include/net/neighbour.h:542 [inline]\\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\\ndst_output include/net/dst.h:451 [inline]\\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\\nsock_sendmsg_nosec net/socket.c:730 [inline]\\n__sock_sendmsg net/socket.c:745 [inline]\\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\\n__sys_sendmsg net/socket.c:2667 [inline]\\n__do_sys_sendmsg net/socket.c:2676 [inline]\\n__se_sys_sendmsg net/socket.c:2674 [inline]\\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\\ndo_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nUninit was created at:\\nslab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\\nslab_alloc_node mm/slub.c:3478 [inline]\\n__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\\n__do_kmalloc_node mm/slab_common.c:1006 [inline]\\n__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027\\nkmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\\npskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098\\n__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655\\npskb_may_pull_reason include/linux/skbuff.h:2673 [inline]\\npskb_may_pull include/linux/skbuff.h:2681 [inline]\\nip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408\\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\\nxmit_one net/core/dev.c:3548 [inline]\\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\\nneigh_output include/net/neighbour.h:542 [inline]\\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\\ndst_output include/net/dst.h:451 [inline]\\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\\nsock_sendmsg_nosec net/socket.c:730 [inline]\\n__sock_sendmsg net/socket.c:745 [inline]\\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\\n__sys_sendmsg net/socket.c:2667 [inline]\\n__do_sys_sendms\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ip6_tunnel: corrige el manejo de NEXTHDR_FRAGMENT en ip6_tnl_parse_tlv_enc_lim() syzbot se\u00f1al\u00f3 [1] que el manejo de NEXTHDR_FRAGMENT no funciona. La lectura de frag_off solo se puede realizar si extraemos suficientes bytes para skb-\u0026gt;head. Actualmente podr\u00edamos acceder a basura. [1] ERROR: KMSAN: valor uninit en ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [en l\u00ednea] ip6_tnl_start_xmit+0x ab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit incluye /linux/netdevice.h:4940 [en l\u00ednea] netdev_start_xmit include/linux/netdevice.h:4954 [en l\u00ednea] xmit_one net/core/dev.c:3548 [en l\u00ednea] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c: 3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [en l\u00ednea] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h :542 [en l\u00ednea] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [en l\u00ednea] ip6_output+0x3 23/ 0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [en l\u00ednea] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [en l\u00ednea] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0 x105/0x190 neto/ipv4 /af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [en l\u00ednea] __sock_sendmsg net/socket.c:745 [en l\u00ednea] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c :2638 __sys_sendmsg net/socket.c:2667 [en l\u00ednea] __do_sys_sendmsg net/socket.c:2676 [en l\u00ednea] __se_sys_sendmsg net/socket.c:2674 [en l\u00ednea] __x64_sys_sendmsg+0x307/0x490 net/socket.c:267 4 do_syscall_x64 arco/ x86/entry/common.c:52 [en l\u00ednea] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit se cre\u00f3 en: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [en l\u00ednea] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [en l\u00ednea] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c :1027 kmalloc_reserve+0x249/ 0x4a0 net/core/skbuff.c:582 pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 __pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2673 [en l\u00ednea ] pskb_may_pull include/linux/skbuff.h:2681 [en l\u00ednea] ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [en l\u00ednea] ip6_tnl_start_xmit+0xab 2/0x1a70 neto/ipv6/ ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [en l\u00ednea] netdev_start_xmit include/linux/netdevice.h:4954 [en l\u00ednea] xmit_one net/core/dev.c:3548 [en l\u00ednea] dev_hard_start_xmit+0x247/0xa10 net /core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [en l\u00ednea] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [en l\u00ednea] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [en l\u00ednea] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [en l\u00ednea] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output .c:1952 [en l\u00ednea] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:9 20 inet_sendmsg +0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [en l\u00ednea] __sock_sendmsg net/socket.c:745 [en l\u00ednea]---truncado---\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.10\",\"versionEndExcluding\":\"4.19.306\",\"matchCriteriaId\":\"9E6972CF-7270-4681-AC42-1BC6AAEB7CDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.268\",\"matchCriteriaId\":\"991BF737-6083-429B-ACD5-FB27D4143E2F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.209\",\"matchCriteriaId\":\"74979A03-4B10-4815-AE3E-C8C0D2FDAA39\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.148\",\"matchCriteriaId\":\"2ED0CDB9-61B0-408E-B2A8-5199107F7868\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.75\",\"matchCriteriaId\":\"070D0ED3-90D0-4F95-B1FF-57D7F46F332D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.14\",\"matchCriteriaId\":\"5C6B50A6-3D8B-4CE2-BDCC-A098609CBA14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.2\",\"matchCriteriaId\":\"7229C448-E0C9-488B-8939-36BA5254065E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7CF3019-975D-40BB-A8A4-894E62BD3797\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*\",\"matchCriteriaId\":\"C2D814BE-93EC-42EF-88C5-EA7E7DF07BE5\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a1k_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F65C59D-249A-4790-892C-B78CF82E51CF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a1k:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F1BD97F-CA60-4401-B1A0-EC4EA5647251\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a70_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F7D6B02-55FE-4BF1-8607-A0D703E61055\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a70:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"532FE51E-41FA-4BFF-81E6-4A6B2666F6F8\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a90_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"550C1E38-56A3-4676-9D28-D66F66BA2FC8\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a90:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0DD2BF6-0943-48C4-BB63-840FC7F0376D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a800_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B36CECA5-4545-49C2-92EB-B739407B207F\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a800:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FE69B5A-CFC0-470E-9846-7D8086814986\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:c800_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5AE3364-DB2D-4543-B1E2-175BF8BEBEE7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:c800:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11E837C7-F91E-4486-B0FD-3222E69AB17D\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a900_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"93B9B933-7D69-4B33-8983-C1CEC000B38B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a900:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"048F04A2-5630-453A-A855-E9314B2BAB62\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:9500_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"866CB169-576D-4ED7-AB9A-2C01D60C26D6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:9500:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"27E91650-A0AF-43BF-985D-7F89D8E8CD31\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:c190_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75A43965-CB2E-4C28-AFC3-1ADE7A6B845C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:c190:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D3202DD-7616-4C9E-AFA1-61A1311F6C42\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a150_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"775078AE-16E0-4AF6-9022-372FC2852107\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a150:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23BA50E9-44A7-4443-AAE7-59911BB24EFE\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:a220_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4F2D2745-242C-4603-899E-70C9025BDDD2\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:a220:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"92AFCF5D-1291-4E75-A12B-B95BBDAC3440\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:fas2720_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B7FD1DA9-7980-4643-B378-7095892DA176\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:fas2720:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C227886-9186-49C3-A2B1-A0C1D5E5705A\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:fas2750_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AD661062-0D5B-4671-9D92-FEF8D7395C1E\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:fas2750:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50B5C295-3711-4002-9D6D-72B6A237F650\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:fas2820_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F997DB9A-AF66-4CE1-B33B-A04493ECBA19\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:fas2820:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"22D33DD7-EB3F-4B85-B9F8-1D744112C9E0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89612649-BACF-4FAC-9BA4-324724FD93A6\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h610c:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3A2FDC2F-BC6C-4845-BF4F-572B7A1432C6\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD7CFE0E-9D1E-4495-B302-89C3096FC0DF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h610s:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80A6BDDA-17BE-4EE5-BEFC-F24235A3C9F3\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5921A877-18BF-43FE-915C-D226E140ACFC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h615c:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"136641AA-7976-4F2D-8336-D75F440D2058\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/135414f300c5db995e2a2f3bf0f455de9d014aee\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f15ba3dc14e6ee002ea01b4faddc3d49200377c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4329426cf6b8e22b798db2331c7ef1dd2a9c748d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/62a1fedeb14c7ac0947ef33fadbabd35ed2400a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/687c5d52fe53e602e76826dbd4d7af412747e183\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ba8d904c274268b18ef3dc11d3ca7b24a96cb087\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/135414f300c5db995e2a2f3bf0f455de9d014aee\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3f15ba3dc14e6ee002ea01b4faddc3d49200377c\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4329426cf6b8e22b798db2331c7ef1dd2a9c748d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/62a1fedeb14c7ac0947ef33fadbabd35ed2400a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/687c5d52fe53e602e76826dbd4d7af412747e183\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ba8d904c274268b18ef3dc11d3ca7b24a96cb087\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20241220-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/135414f300c5db995e2a2f3bf0f455de9d014aee\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3f15ba3dc14e6ee002ea01b4faddc3d49200377c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4329426cf6b8e22b798db2331c7ef1dd2a9c748d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/62a1fedeb14c7ac0947ef33fadbabd35ed2400a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/687c5d52fe53e602e76826dbd4d7af412747e183\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ba8d904c274268b18ef3dc11d3ca7b24a96cb087\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00016.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20241220-0001/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-12-20T13:06:42.426Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26633\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-18T19:01:45.822242Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"description\": \"CWE-noinfo Not enough information\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:18.545Z\"}}], \"cna\": {\"title\": \"ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fbfa743a9d2a0ffa24251764f10afc13eb21e739\", \"lessThan\": \"135414f300c5db995e2a2f3bf0f455de9d014aee\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fbfa743a9d2a0ffa24251764f10afc13eb21e739\", \"lessThan\": \"3f15ba3dc14e6ee002ea01b4faddc3d49200377c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fbfa743a9d2a0ffa24251764f10afc13eb21e739\", \"lessThan\": \"da23bd709b46168f7dfc36055801011222b076cd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fbfa743a9d2a0ffa24251764f10afc13eb21e739\", \"lessThan\": \"4329426cf6b8e22b798db2331c7ef1dd2a9c748d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fbfa743a9d2a0ffa24251764f10afc13eb21e739\", \"lessThan\": \"62a1fedeb14c7ac0947ef33fadbabd35ed2400a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fbfa743a9d2a0ffa24251764f10afc13eb21e739\", \"lessThan\": \"687c5d52fe53e602e76826dbd4d7af412747e183\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fbfa743a9d2a0ffa24251764f10afc13eb21e739\", \"lessThan\": \"ba8d904c274268b18ef3dc11d3ca7b24a96cb087\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"fbfa743a9d2a0ffa24251764f10afc13eb21e739\", \"lessThan\": \"d375b98e0248980681e5e56b712026174d617198\", \"versionType\": \"git\"}], \"programFiles\": [\"net/ipv6/ip6_tunnel.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.10\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.10\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.306\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.268\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.209\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.148\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.75\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/ipv6/ip6_tunnel.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/135414f300c5db995e2a2f3bf0f455de9d014aee\"}, {\"url\": \"https://git.kernel.org/stable/c/3f15ba3dc14e6ee002ea01b4faddc3d49200377c\"}, {\"url\": \"https://git.kernel.org/stable/c/da23bd709b46168f7dfc36055801011222b076cd\"}, {\"url\": \"https://git.kernel.org/stable/c/4329426cf6b8e22b798db2331c7ef1dd2a9c748d\"}, {\"url\": \"https://git.kernel.org/stable/c/62a1fedeb14c7ac0947ef33fadbabd35ed2400a2\"}, {\"url\": \"https://git.kernel.org/stable/c/687c5d52fe53e602e76826dbd4d7af412747e183\"}, {\"url\": \"https://git.kernel.org/stable/c/ba8d904c274268b18ef3dc11d3ca7b24a96cb087\"}, {\"url\": \"https://git.kernel.org/stable/c/d375b98e0248980681e5e56b712026174d617198\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()\\n\\nsyzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.\\n\\nReading frag_off can only be done if we pulled enough bytes\\nto skb-\u003ehead. Currently we might access garbage.\\n\\n[1]\\nBUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\\nip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0\\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\\nxmit_one net/core/dev.c:3548 [inline]\\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\\nneigh_output include/net/neighbour.h:542 [inline]\\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\\ndst_output include/net/dst.h:451 [inline]\\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\\nsock_sendmsg_nosec net/socket.c:730 [inline]\\n__sock_sendmsg net/socket.c:745 [inline]\\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\\n__sys_sendmsg net/socket.c:2667 [inline]\\n__do_sys_sendmsg net/socket.c:2676 [inline]\\n__se_sys_sendmsg net/socket.c:2674 [inline]\\n__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674\\ndo_syscall_x64 arch/x86/entry/common.c:52 [inline]\\ndo_syscall_64+0x44/0x110 arch/x86/entry/common.c:83\\nentry_SYSCALL_64_after_hwframe+0x63/0x6b\\n\\nUninit was created at:\\nslab_post_alloc_hook+0x129/0xa70 mm/slab.h:768\\nslab_alloc_node mm/slub.c:3478 [inline]\\n__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517\\n__do_kmalloc_node mm/slab_common.c:1006 [inline]\\n__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027\\nkmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582\\npskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098\\n__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655\\npskb_may_pull_reason include/linux/skbuff.h:2673 [inline]\\npskb_may_pull include/linux/skbuff.h:2681 [inline]\\nip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408\\nipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]\\nip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432\\n__netdev_start_xmit include/linux/netdevice.h:4940 [inline]\\nnetdev_start_xmit include/linux/netdevice.h:4954 [inline]\\nxmit_one net/core/dev.c:3548 [inline]\\ndev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564\\n__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349\\ndev_queue_xmit include/linux/netdevice.h:3134 [inline]\\nneigh_connected_output+0x569/0x660 net/core/neighbour.c:1592\\nneigh_output include/net/neighbour.h:542 [inline]\\nip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137\\nip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222\\nNF_HOOK_COND include/linux/netfilter.h:303 [inline]\\nip6_output+0x323/0x610 net/ipv6/ip6_output.c:243\\ndst_output include/net/dst.h:451 [inline]\\nip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155\\nip6_send_skb net/ipv6/ip6_output.c:1952 [inline]\\nip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972\\nrawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582\\nrawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920\\ninet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847\\nsock_sendmsg_nosec net/socket.c:730 [inline]\\n__sock_sendmsg net/socket.c:745 [inline]\\n____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584\\n___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638\\n__sys_sendmsg net/socket.c:2667 [inline]\\n__do_sys_sendms\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.306\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.268\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.209\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.148\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.75\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.14\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.2\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"4.10\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.2.87\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.10.106\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.12.71\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.16.42\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"3.18.49\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.4.50\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.9.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T08:52:44.043Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26633\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T08:52:44.043Z\", \"dateReserved\": \"2024-02-19T14:20:24.136Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-03-18T10:07:49.468Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

RHSA-2024:2394

Vulnerability from csaf_redhat

Published

2024-04-30 09:57

Modified

2025-05-21 03:30

Summary

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Notes

Topic

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546) * kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582) * kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555) * kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480) * kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448) * kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934) * kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040) * kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531) * kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931) * kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023) * kernel: irdma: Improper access control (CVE-2023-25775) * Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464) * kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866) * kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083) * kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194) * kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756) * kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863) * kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434) * kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489) * kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522) * kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581) * kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578) * kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580) * kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610) * kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565) * kernel: tls: race between async notify and socket close (CVE-2024-26583) * kernel: tls: handle backlogging of crypto requests (CVE-2024-26584) * kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585) * kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586) * kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593) * kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602) * kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609) * kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176) * kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476) * kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620) * kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes linked from the References section.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.