CVE-2024-26852Use After Free in Linux

CWE-416Use After Free36 documents7 sources
Severity
7.8HIGHNVD
OSV7.0OSV6.5OSV5.5
EPSS
0.0%
top 98.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 17
Latest updateJul 26

Description

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") was not able to fix the root cause. We need to defer the fib6_info_release() calls after ip6_route_mpath_notify(), in the cleanup phase. [1] BUG: KASAN: slab-use-after-free in rt6_fill_node+0x1460/0x1ac0 Read of size 4

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

NVDlinux/linux_kernel4.114.19.310+7
Debianlinux/linux_kernel< 5.10.216-1+3
Ubuntulinux/linux_kernel< 5.4.0-189.209+1
CVEListV5linux/linux3b1137fe74829e021f483756a648cbb87c8a1b4a31ea5bcc7d4cd1423de6be327a2c034725704136+8
debiandebian/linux< linux 6.1.82-1 (bookworm)

Also affects: Debian Linux 10.0

Patches

🔴Vulnerability Details

17
OSV
linux-raspi vulnerabilities2024-07-26
OSV
linux-aws, linux-aws-5.4, linux-iot vulnerabilities2024-07-23
OSV
linux-raspi, linux-raspi-5.4 vulnerabilities2024-07-19
OSV
linux-oracle, linux-xilinx-zynqmp vulnerabilities2024-07-17
OSV
linux-hwe-5.4, linux-oracle-5.4 vulnerabilities2024-07-16

📋Vendor Advisories

17
Ubuntu
Linux kernel vulnerabilities2024-07-26
Ubuntu
Linux kernel vulnerabilities2024-07-23
Ubuntu
Linux kernel vulnerabilities2024-07-19
Ubuntu
Linux kernel vulnerabilities2024-07-17
Ubuntu
Linux kernel vulnerabilities2024-07-16

💬Community

1
Bugzilla
CVE-2024-26852 kernel: net/ipv6: avoid possible UAF in ip6_route_mpath_notify()2024-04-17