CVE-2024-44944

2024-08-3008:15:04

CWE-401

416baaa9-dc9f-4396-8d5f-8c081fb06d67

web.nvd.nist.gov

linux kernel

netfilter

ctnetlink

expectation path

vulnerability

helper function

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

5.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ctnetlink: use helper function to calculate expect ID

Delete expectation path is missing a call to the nf_expect_get_id()
helper function to calculate the expectation ID, otherwise LSB of the
expectation object address is leaked to userspace.

Affected configurations

Nvd

Node

linuxlinux_kernelRange5.2–5.4.282

linuxlinux_kernelRange5.5–5.10.224

linuxlinux_kernelRange5.11–5.15.165

linuxlinux_kernelRange5.16–6.1.103

linuxlinux_kernelRange6.2–6.6.44

linuxlinux_kernelRange6.7–6.10.3

linuxlinux_kernelMatch4.19.320

linuxlinux_kernelMatch5.1

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linuxlinux_kernel4.19.320cpe:2.3:o:linux:linux_kernel:4.19.320:*:*:*:*:*:*:*
linuxlinux_kernel5.1cpe:2.3:o:linux:linux_kernel:5.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	4.19.320	cpe:2.3:o:linux:linux_kernel:4.19.320:::::::*
linux	linux_kernel	5.1	cpe:2.3:o:linux:linux_kernel:5.1:::::::*