CVE-2024-26804

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110 mm/kasan/report.c:588 __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline] ___skb_get_hash net/core/flow_dissector.c:1791 [inline] __skb_get_hash+0xc7/0x540 net/core/flo...

Affected product and versions

Product

Linux Linux, linux kernel, debian linux

Affected versions

>= 243aad830e8a4cdda261626fbaeddde16b08d04a < f81e94d2dcd2397137edcb8b85f4c5bed5d22383, >= 243aad830e8a4cdda261626fbaeddde16b08d04a < 2e95350fe9db9d53c701075060ac8ac883b68aee, >= 243aad830e8a4cdda261626fbaeddde16b08d04a < afec0c5cd2ed71ca95a8b36a5e6d03333bf34282, >= 243aad830e8a4cdda261626fbaeddde16b08d04a < ab63de24ebea36fe73ac7121738595d704b66d96, >= 243aad830e8a4cdda261626fbaeddde16b08d04a < a0a1db40b23e8ff86dea2786c5ea1470bb23ecb9, >= 243aad830e8a4cdda261626fbaeddde16b08d04a < 049d7989c67e8dd50f07a2096dbafdb41331fb9b, >= 243aad830e8a4cdda261626fbaeddde16b08d04a < 5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f, >= 03017375b0122453e6dda833ff7bd4191915def5, >= 2.6.33.2 < 2.6.34, >= 2.6.34, >= 2.6.34 < 5.4.271, >= 5.5 < 5.10.212, >= 5.11 < 5.15.151, >= 5.16 < 6.1.81, >= 6.2 < 6.6.21, >= 6.7 < 6.7.9, 6.8, 10.0

Fixed versions

5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416