PT-2024-33782 · Linux+5 · Linux Kernel+5
Published
2024-07-29
·
Updated
2026-05-26
·
CVE-2024-49940
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The issue is related to a possible tunnel refcount underflow in the Linux kernel's l2tp module. When a session is created, it sets a backpointer to its tunnel, and when the session refcount drops to 0, the tunnel refcount is dropped if
session->tunnel is non-NULL. However, there is a small window where session->tunnel is non-NULL when the tunnel refcount hasn't been incremented. To fix this, an encap argument is added to l2tp session set header len to avoid using session->tunnel. Additionally, a check is added to handle the case where l2tpv3 sessions have colliding IDs and l2tp v3 session get races with l2tp session register.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu