SECUFOCUSNOW
Home›CVE index›CVE-2024-26898
Review reviewHigh

CVE-2024-26898

Linux Linux, linux_kernel, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. In aoecmd_cfg_pkts(), it always...

CVSS
7.8
EPSS
0.30%
22.8% percentile
CISA KEV
Not listed
Published
2024.04.17
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.30%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access through the `skbtxq` global queue. This could lead to a denial of service condition or potential code execution. In aoecmd_cfg_pkts(), it always...

Affected product and versions

Product
Linux Linux, linux_kernel, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Affected versions
>= 7562f876cd93800f2f8c89445f2a563590b24e09 < ad80c34944d7175fa1f5c7a55066020002921a99, >= 7562f876cd93800f2f8c89445f2a563590b24e09 < 1a54aa506b3b2f31496731039e49778f54eee881, >= 7562f876cd93800f2f8c89445f2a563590b24e09 < faf0b4c5e00bb680e8e43ac936df24d3f48c8e65, >= 7562f876cd93800f2f8c89445f2a563590b24e09 < 7dd09fa80b0765ce68bfae92f4e2f395ccf0fba4, >= 7562f876cd93800f2f8c89445f2a563590b24e09 < 74ca3ef68d2f449bc848c0a814cefc487bf755fa, >= 7562f876cd93800f2f8c89445f2a563590b24e09 < eb48680b0255a9e8a9bdc93d6a55b11c31262e62, >= 7562f876cd93800f2f8c89445f2a563590b24e09 < 079cba4f4e307c69878226fdf5228c20aa1c969c, >= 7562f876cd93800f2f8c89445f2a563590b24e09 < a16fbb80064634b254520a46395e36b87ca4731e, >= 7562f876cd93800f2f8c89445f2a563590b24e09 < f98364e926626c678fb4b9004b75cacf92ff0662, >= 2.6.22, >= 7562f876cd93 < ad80c34944d7, >= 7562f876cd93 < 1a54aa506b3b, >= 7562f876cd93 < faf0b4c5e00b, >= 7562f876cd93 < 7dd09fa80b07, >= 7562f876cd93 < 74ca3ef68d2f, >= 7562f876cd93 < eb48680b0255, >= 7562f876cd93 < 079cba4f4e30, >= 7562f876cd93 < a16fbb800646, >= 7562f876cd93 < f98364e92662, >= V3.1.0 < V3.1.5
Fixed versions
4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux_kernel, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416
CVE-2024-26898 — Linux Linux, linux_kernel, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem | SECUFOCUS NOW