CVE-2024-50033

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() only checked the size of the packet was at least 20, which is not good enough. We need to make sure the packet includes the IPv4 and TCP header that are supposed to be carried. Add iph and th pointers to make the code more readable. [1] BUG: KMSAN: uninit-value in slhc_remember+0x2e8/0x7b0 drivers/net/slip/slhc.c:666 slhc_remember+0x2e8/0x7b0 drivers/net/slip/sl...

Affected product and versions

Product

Linux Linux, RUGGEDCOM RST2428P, SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family

Affected versions

>= b5451d783ade99308dfccdf5ca284ed07affa4ff < ba6501ea06462d6404d57d5644cf2854db38e7d7, >= b5451d783ade99308dfccdf5ca284ed07affa4ff < 36b054324d18e51cf466134e13b6fbe3c91f52af, >= b5451d783ade99308dfccdf5ca284ed07affa4ff < 5e336384cc9b608e0551f99c3d87316ca3b0e51a, >= b5451d783ade99308dfccdf5ca284ed07affa4ff < ff5e0f895315706e4ca5a19df15be6866cee4f5d, >= b5451d783ade99308dfccdf5ca284ed07affa4ff < 8bb79eb1db85a10865f0d4dd15b013def3f2d246, >= b5451d783ade99308dfccdf5ca284ed07affa4ff < 29e8d96d44f51cf89a62dd042be35d052833b95c, >= b5451d783ade99308dfccdf5ca284ed07affa4ff < 7d3fce8cbe3a70a1c7c06c9b53696be5d5d8dd5c, >= 3.2, < V3.2, >= 3.2 < 5.10.227, >= 5.11 < 5.15.168, >= 5.16 < 6.1.113, >= 6.2 < 6.6.57, >= 6.7 < 6.11.4, 6.12

Fixed versions

5.10.227, 5.15.168, 6.1.113, 6.6.57, 6.11.4

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE

CWE-908