PT-2024-29260 · Linux+9 · Linux Kernel+9
Si-Wei Liu
·
Published
2024-07-24
·
Updated
2026-01-12
·
CVE-2024-41090
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability in the Linux kernel has been resolved, related to the tap get user xdp() path, where a missing verification for short frames could cause a corrupted skb to be sent downstack. This could lead to out-of-bound access beyond the actual length or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. The alternative path, tap get user(), already prohibits short frames with lengths less than the Ethernet header size from being transmitted.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Out of bounds Read
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu