by Kastro
Paper/Archive/CVE-2024-49571

CVE-2024-49571

Linux Linux — net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 47.8.478 × 209.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field iparea_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks iparea_offset and ipv6_prefixes_cnt before using them.

Affected

ProductAffectedFixed inSource
Linuxe7b7a64a8493d47433fd003efbe6543e3f676294 – < 846bada23bfcdeb83621b045ed85dc06c7833ff0846bada23bfcdeb83621b045ed85dc06c7833ff0CNA
Linuxe7b7a64a8493d47433fd003efbe6543e3f676294 – < f10635268a0a49ee902a3b63b5dbb76f4fed498ef10635268a0a49ee902a3b63b5dbb76f4fed498eCNA
Linuxe7b7a64a8493d47433fd003efbe6543e3f676294 – < 62056d1592e63d85e82357ee2ae6a6a294f440b062056d1592e63d85e82357ee2ae6a6a294f440b0CNA
Linuxe7b7a64a8493d47433fd003efbe6543e3f676294 – < 91a7c27c1444ed4677b83fd5308d2cf03f5f085191a7c27c1444ed4677b83fd5308d2cf03f5f0851CNA
Linuxe7b7a64a8493d47433fd003efbe6543e3f676294 – < 47ce46349672a7e0c361bfe39ed0b22e824ef4fb47ce46349672a7e0c361bfe39ed0b22e824ef4fbCNA
Linuxe7b7a64a8493d47433fd003efbe6543e3f676294 – < a29e220d3c8edbf0e1beb0f028878a4a85966556a29e220d3c8edbf0e1beb0f028878a4a85966556CNA
Linux4.16–CNA

Scores by source

Linux (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References

refgit.kernel.org/stable/c/846bada23bfcdeb83621b045ed85dc06c7833ff0refgit.kernel.org/stable/c/f10635268a0a49ee902a3b63b5dbb76f4fed498erefgit.kernel.org/stable/c/62056d1592e63d85e82357ee2ae6a6a294f440b0refgit.kernel.org/stable/c/91a7c27c1444ed4677b83fd5308d2cf03f5f0851refgit.kernel.org/stable/c/47ce46349672a7e0c361bfe39ed0b22e824ef4fbrefgit.kernel.org/stable/c/a29e220d3c8edbf0e1beb0f028878a4a85966556reflists.debian.org/debian-lts-announce/2025/03/msg00001.html