PT-2024-26816 · Linux+6 · Linux Kernel+6
Syzbot
·
Published
2024-04-04
·
Updated
2025-09-29
·
CVE-2024-35976
CVSS v3.1
6.7
Medium
| Vector | AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.8.0
Description
The vulnerability is related to the xsk (Express Data Path) feature in the Linux kernel. It was reported by syzbot, which detected an illegal copy in the xsk setsockopt() function. The issue arises from the failure to validate user input for XDP UMEM FILL RING and XDP COMPLETION FILL RING, leading to a slab-out-of-bounds error. This can be exploited by providing a specially crafted optlen parameter to the setsockopt() function, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service condition.
Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability. Ensure that the updated kernel version validates user input for XDP UMEM FILL RING and XDP COMPLETION FILL RING to prevent slab-out-of-bounds errors. Additionally, consider implementing security measures such as input validation and error handling to prevent similar vulnerabilities in the future.
Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu