CVE-2024-44935 — NULL Pointer Dereference in Linux
Severity
5.5MEDIUMNVD
OSV8.8OSV7.1
EPSS
0.0%
top 93.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 26
Latest updateAug 14
Description
In the Linux kernel, the following vulnerability has been resolved:
sctp: Fix null-ptr-deref in reuseport_add_sock().
syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in
reuseport_add_sock(). [0]
The repro first creates a listener with SO_REUSEPORT. Then, it creates
another listener on the same port and concurrently closes the first
listener.
The second listen() calls reuseport_add_sock() with the first listener as
sk2, where sk2->sk_reuseport_cb is not expected to be cl…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6
Affected Packages10 packages
▶CVEListV5linux/linux6ba84574026792ce33a40c7da721dea36d0f3973 — c9b3fc4f157867e858734e31022ebee8a24f0de7+7