PT-2024-3388 · Linux+5 · Linux Kernel+5
Syzbot
·
Published
2024-01-19
·
Updated
2025-03-10
·
CVE-2024-26636
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel versions prior to 6.7.0
Description:
A vulnerability in the Linux kernel's llc ui sendmsg() function allows an attacker to cause a denial of service. The issue occurs when the function releases the socket lock before calling sock alloc send skb(), and then reacquires it without redoing the sanity checks. This can lead to a kernel BUG at net/core/skbuff.c:193. The vulnerability can be exploited by syzbot, which can trick llc ui sendmsg() into allocating an skb with no headroom and then trying to push 14 bytes of Ethernet header.
Recommendations:
To resolve this issue, update the Linux kernel to version 6.7.0 or later, which includes the fix for this vulnerability. The fix uses LL RESERVED SPACE() to reserve space, checks all conditions again after the socket lock is held, and does not account for the Ethernet header in mtu limitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu