CVE-2024-44944

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-44944
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/24f407042cf90b0872de667460230d8d50c06c39 Patch
https://git.kernel.org/stable/c/27662b46f2adaa52c1665a82af4b21c42c4337fd Patch
https://git.kernel.org/stable/c/5e2c24f7b0911b15c29aefce760bcf770542fb61 Patch
https://git.kernel.org/stable/c/64c0b8e64be8368617ef08dfc59a3160563a1435 Patch
https://git.kernel.org/stable/c/66e7650dbbb8e236e781c670b167edc81e771450 Patch
https://git.kernel.org/stable/c/74de442b8e12a207c07953ee068009a7701aff8f Patch
https://git.kernel.org/stable/c/782161895eb4ac45cf7cfa8db375bd4766cb8299 Patch
https://git.kernel.org/stable/c/eb4ca1a97e08ff5b920664ba292e576257e2d184 Patch
https://www.zerodayinitiative.com/advisories/ZDI-24-1182/
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.19.320:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.1:*:*:*:*:*:*:*
History

10 Sep 2024, 08:15

Type Values Removed Values Added
References
  • () https://www.zerodayinitiative.com/advisories/ZDI-24-1182/ -

03 Sep 2024, 14:49

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.19.320:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.1:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: ctnetlink: usar la función auxiliar para calcular el ID de expectativa. Al eliminar la ruta de expectativa falta una llamada a la función auxiliar nf_expect_get_id() para calcular el ID de expectativa; de lo contrario, el LSB de la dirección del objeto de expectativa se filtra al espacio de usuario.
References () https://git.kernel.org/stable/c/24f407042cf90b0872de667460230d8d50c06c39 - () https://git.kernel.org/stable/c/24f407042cf90b0872de667460230d8d50c06c39 - Patch
References () https://git.kernel.org/stable/c/27662b46f2adaa52c1665a82af4b21c42c4337fd - () https://git.kernel.org/stable/c/27662b46f2adaa52c1665a82af4b21c42c4337fd - Patch
References () https://git.kernel.org/stable/c/5e2c24f7b0911b15c29aefce760bcf770542fb61 - () https://git.kernel.org/stable/c/5e2c24f7b0911b15c29aefce760bcf770542fb61 - Patch
References () https://git.kernel.org/stable/c/64c0b8e64be8368617ef08dfc59a3160563a1435 - () https://git.kernel.org/stable/c/64c0b8e64be8368617ef08dfc59a3160563a1435 - Patch
References () https://git.kernel.org/stable/c/66e7650dbbb8e236e781c670b167edc81e771450 - () https://git.kernel.org/stable/c/66e7650dbbb8e236e781c670b167edc81e771450 - Patch
References () https://git.kernel.org/stable/c/74de442b8e12a207c07953ee068009a7701aff8f - () https://git.kernel.org/stable/c/74de442b8e12a207c07953ee068009a7701aff8f - Patch
References () https://git.kernel.org/stable/c/782161895eb4ac45cf7cfa8db375bd4766cb8299 - () https://git.kernel.org/stable/c/782161895eb4ac45cf7cfa8db375bd4766cb8299 - Patch
References () https://git.kernel.org/stable/c/eb4ca1a97e08ff5b920664ba292e576257e2d184 - () https://git.kernel.org/stable/c/eb4ca1a97e08ff5b920664ba292e576257e2d184 - Patch
CWE CWE-401
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux

30 Aug 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-30 08:15

Updated : 2024-09-10 08:15

NVD link : CVE-2024-44944

Mitre link : CVE-2024-44944

CVE.ORG link : CVE-2024-44944

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime