CVE-2024-26597

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See bug trace below: ================================================================== BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline] BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600 Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207 CPU: 0 PID: 84207 Comm...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 14452ca3b5ce304fb2fea96dbc9ca1e4e7978551 < 093dab655808207f7a9f54cf156240aeafc70590, >= 14452ca3b5ce304fb2fea96dbc9ca1e4e7978551 < 02467ab8b404d80429107588e0f3425cf5fcd2e5, >= 14452ca3b5ce304fb2fea96dbc9ca1e4e7978551 < 2295c22348faf795e1ccdf618f6eb7afdb2f7447, >= 14452ca3b5ce304fb2fea96dbc9ca1e4e7978551 < 3b5254862258b595662a0ccca6e9eeb88d6e7468, >= 14452ca3b5ce304fb2fea96dbc9ca1e4e7978551 < ee1dc3bf86f2df777038506b139371a9add02534, >= 14452ca3b5ce304fb2fea96dbc9ca1e4e7978551 < c4734535034672f59f2652e1e0058c490da62a5c, >= 14452ca3b5ce304fb2fea96dbc9ca1e4e7978551 < 17d06a5c44d8fd2e8e61bac295b09153496f87e1, >= 14452ca3b5ce304fb2fea96dbc9ca1e4e7978551 < b33fb5b801c6db408b774a68e7c8722796b59ecc, >= 4.17, >= 4.17.0 < 4.19.306, >= 4.20.0 < 5.4.268, >= 5.5.0 < 5.10.209, >= 5.11.0 < 5.15.148, >= 5.16.0 < 6.1.75, >= 6.2.0 < 6.6.14, >= 6.7.0 < 6.7.2

Fixed versions

4.19.306, 5.4.268, 5.10.209, 5.15.148, 6.1.75, 6.6.14, 6.7.2

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-125