CVE-2024-35969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6getifaddr and ipv6deladdr Although ipv6getifaddr walks inet6addrlst under the RCU lock, it still means hlistforeachentryrcu can return an item that got removed from the list. The memory itself...

UBUNTU-CVE-2024-35969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6getifaddr and ipv6deladdr Although ipv6getifaddr walks inet6addrlst under the RCU lock, it still means hlistforeachentryrcu can return an item that got removed from the list. The memory itself...

CVE-2024-35969 ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6getifaddr and ipv6deladdr Although ipv6getifaddr walks inet6addrlst under the RCU lock, it still means hlistforeachentryrcu can return an item that got removed from the list. The memory itself...

CVE-2024-35969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6getifaddr and ipv6deladdr Although ipv6getifaddr walks inet6addrlst under the RCU lock, it still means hlistforeachentryrcu can return an item that got removed from the list. The memory itself...

CVE-2024-35969 ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6getifaddr and ipv6deladdr Although ipv6getifaddr walks inet6addrlst under the RCU lock, it still means hlistforeachentryrcu can return an item that got removed from the list. The memory itself...

CVE-2024-35969

Summary (CVE-2024-35969): A race in IPv6 handling in the Linux kernel between ipv6_get_ifaddr and ipv6_del_addr can cause use-after-free scenarios. When an entry is removed from inet6_addr_lst under RCU, ipv6_get_ifaddr may still return that entry and attempt to increment its reference, leading t...

CVE-2024-35969 ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix race condition between ipv6getifaddr and ipv6deladdr Although ipv6getifaddr walks inet6addrlst under the RCU lock, it still means hlistforeachentryrcu can return an item that got removed from the list. The memory itself...

CVE-2024-35886

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6dumpdone. syzkaller reported infinite recursive calls of fib6dumpdone during netlink socket destruction. 1 From the log, syzkaller sent an AFUNSPEC RTMGETROUTE message, and then the response wa...

DEBIAN-CVE-2024-35886

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6dumpdone. syzkaller reported infinite recursive calls of fib6dumpdone during netlink socket destruction. 1 From the log, syzkaller sent an AFUNSPEC RTMGETROUTE message, and then the response wa...

CVE-2024-35890

In the Linux kernel, the following vulnerability has been resolved: gro: fix ownership transfer If packets are GROed with fraglist they might be segmented later on and continue their journey in the stack. In skbsegmentlist those skbs can be reused as-is. This is an issue as their destructor was...

CVE-2024-35886

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6dumpdone. syzkaller reported infinite recursive calls of fib6dumpdone during netlink socket destruction. 1 From the log, syzkaller sent an AFUNSPEC RTMGETROUTE message, and then the response wa...

CVE-2024-35886 ipv6: Fix infinite recursion in fib6_dump_done().

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6dumpdone. syzkaller reported infinite recursive calls of fib6dumpdone during netlink socket destruction. 1 From the log, syzkaller sent an AFUNSPEC RTMGETROUTE message, and then the response wa...

CVE-2024-35886 ipv6: Fix infinite recursion in fib6_dump_done().

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6dumpdone. syzkaller reported infinite recursive calls of fib6dumpdone during netlink socket destruction. 1 From the log, syzkaller sent an AFUNSPEC RTMGETROUTE message, and then the response wa...

CVE-2024-35886

CVE-2024-35886: Linux kernel vulnerability in IPv6 routing dump logic caused infinite recursion in fib6_dump_done() during netlink dump (AF_UNSPEC RTM_GETROUTE/more data). Logs show repeated fib6_dump_done() calls and a stack guard page hit due to recursive destructor behavior. The publicly repor...

CVE-2024-35886 ipv6: Fix infinite recursion in fib6_dump_done().

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix infinite recursion in fib6dumpdone. syzkaller reported infinite recursive calls of fib6dumpdone during netlink socket destruction. 1 From the log, syzkaller sent an AFUNSPEC RTMGETROUTE message, and then the response wa...

CVE-2023-52698

In the Linux kernel, the following vulnerability has been resolved: calipso: fix memory leak in netlblcalipsoaddpass If IPv6 support is disabled at boot ipv6.disable=1, the calipsoinit - netlblcalipsoopsregister function isn't called, and the netlblcalipsoopsget function always returns NULL. In...

CVE-2024-27417

A flaw was discovered in the Linux kernel's IPv6 implementation, specifically within the inet6rtmgetaddr function. The issue arises when user space provides a valid IFATARGETNETNSID value but omits the IFAADDRESS and IFALOCAL attributes. In such cases, the function returns an -EINVAL error while...

CVE-2023-52698

In the Linux kernel, the following vulnerability has been resolved: calipso: fix memory leak in netlblcalipsoaddpass If IPv6 support is disabled at boot ipv6.disable=1, the calipsoinit - netlblcalipsoopsregister function isn't called, and the netlblcalipsoopsget function always returns NULL. In...

CVE-2023-52698

In the Linux kernel, the following vulnerability has been resolved: calipso: fix memory leak in netlblcalipsoaddpass If IPv6 support is disabled at boot ipv6.disable=1, the calipsoinit - netlblcalipsoopsregister function isn't called, and the netlblcalipsoopsget function always returns NULL. In...

CVE-2024-27417

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6rtmgetaddr It seems that if userspace provides a correct IFATARGETNETNSID value but no IFAADDRESS and IFALOCAL attributes, inet6rtmgetaddr returns -EINVAL with an elevated "struct net...