CVE-2024-47659

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'foo' in returned ipv4 packets. So, 1) returned packets are incorrectly labeled ('foo' instead of 'bar') 2) 'bar' can write to 'foo' without being authorized to write. Here is a scenario how to see this: * Take two machines, let's call them C and S, with active Smack in the default state (no settings, no rules, no labeled hosts, only built...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 07feee8f812f7327a46186f7604df312c8c81962 < d3f56c653c65f170b172d3c23120bc64ada645d8, >= 07feee8f812f7327a46186f7604df312c8c81962 < 5b4b304f196c070342e32a4752e1fa2e22fc0671, >= 07feee8f812f7327a46186f7604df312c8c81962 < a948ec993541db4ef392b555c37a1186f4d61670, >= 07feee8f812f7327a46186f7604df312c8c81962 < 0aea09e82eafa50a373fc8a4b84c1d4734751e2c, >= 07feee8f812f7327a46186f7604df312c8c81962 < 0776bcf9cb6de46fdd94d10118de1cf9b05f83b9, >= 07feee8f812f7327a46186f7604df312c8c81962 < 4be9fd15c3c88775bdf6fa37acabe6de85beebff, >= 07feee8f812f7327a46186f7604df312c8c81962 < d3703fa94116fed91f64c7d1c7d284fb4369070f, >= 07feee8f812f7327a46186f7604df312c8c81962 < 2fe209d0ad2e2729f7e22b9b31a86cc3ff0db550, >= 2.6.30, < 4.19.322, >= 4.20 < 5.4.284, >= 5.5 < 5.10.226, >= 5.11 < 5.15.167, >= 5.16 < 6.1.109, >= 6.2 < 6.6.50, >= 6.7 < 6.10.9

Fixed versions

4.19.322, 5.4.284, 5.10.226, 5.15.167, 6.1.109, 6.6.50, 6.10.9

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Not available