CVE-2024-35969

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr Although ipv6_get_ifaddr walks inet6_addr_lst under the RCU lock, it still means hlist_for_each_entry_rcu can return an item that got removed from the list. The memory itself of such item is not freed thanks to RCU but nothing guarantees the actual content of the memory is sane. In particular, the reference count can be zero. This can happen if ipv6_del_addr is called in parallel. ipv6_del_addr removes the entry from inet6_addr_lst (hlist_del_init_rcu(&ifp->...

Affected product and versions

Product

Linux Linux, RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Affected versions

>= 5c578aedcb21d79eeb4e9cf04ca5b276ac82614c < b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1, >= 5c578aedcb21d79eeb4e9cf04ca5b276ac82614c < cca606e14264098cba65efa82790825dbf69e903, >= 5c578aedcb21d79eeb4e9cf04ca5b276ac82614c < 3fb02ec57ead2891a2306af8c51a306bc5945e70, >= 5c578aedcb21d79eeb4e9cf04ca5b276ac82614c < 4b19e9507c275de0cfe61c24db69179dc52cf9fb, >= 5c578aedcb21d79eeb4e9cf04ca5b276ac82614c < de76ae9ea1a6cf9e77fcec4f2df2904e26c23ceb, >= 5c578aedcb21d79eeb4e9cf04ca5b276ac82614c < 01b11a0566670612bd464a932e5ac2eae53d8652, >= 5c578aedcb21d79eeb4e9cf04ca5b276ac82614c < 6cdb20c342cd0193d3e956e3d83981d0f438bb83, >= 5c578aedcb21d79eeb4e9cf04ca5b276ac82614c < 7633c4da919ad51164acbf1aa322cc1a3ead6129, >= 2.6.35, < V3.1, >= 2.6.35 < 4.19.313, >= 4.20 < 5.4.275, >= 5.5 < 5.10.216, >= 5.11 < 5.15.156, >= 5.16 < 6.1.87, >= 6.2 < 6.6.28, >= 6.7 < 6.8.7, 6.9, 10.0

Fixed versions

4.19.313, 5.4.275, 5.10.216, 5.15.156, 6.1.87, 6.6.28, 6.8.7

Technical data

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-770