CVE-2024-44944Missing Release of Memory after Effective Lifetime in Linux

Severity
5.5MEDIUMNVD
OSV8.8OSV7.1
EPSS
0.0%
top 95.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedAug 30
Latest updateAug 14

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages10 packages

NVDlinux/linux_kernel5.25.4.282+7
Debianlinux/linux_kernel< 5.10.226-1+3
Ubuntulinux/linux_kernel< 5.4.0-200.220+4
CVEListV5linux/linux7b115755fb9d3aff0ddcd18a5c4d83381362acce66e7650dbbb8e236e781c670b167edc81e771450+13
debiandebian/linux< linux 6.1.106-1 (bookworm)

Patches

🔴Vulnerability Details

22
OSV
linux-azure, linux-azure-6.8 vulnerabilities2025-01-09
OSV
linux-azure-5.15 vulnerabilities2025-01-09
OSV
linux-azure, linux-azure-4.15 vulnerabilities2025-01-09
OSV
linux-hwe-6.8 vulnerabilities2025-01-06
OSV
linux, linux-lts-xenial vulnerabilities2025-01-06

📋Vendor Advisories

24
CISA ICS
Siemens Third-Party Components in SINEC OS2025-08-14
Ubuntu
Linux kernel (Azure) vulnerabilities2025-01-09
Ubuntu
Linux kernel (Azure) vulnerabilities2025-01-09
Ubuntu
Linux kernel (Azure) vulnerabilities2025-01-09
Ubuntu
Linux kernel (HWE) vulnerabilities2025-01-06