PT-2024-3426 · Linux+7 · Linux Kernel+7
Syzbot
·
Published
2024-03-08
·
Updated
2025-09-29
·
CVE-2024-26882
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Linux kernel (affected versions not specified)
Description:
The vulnerability is related to the
ip tunnel rcv() function in the Linux kernel, which fails to properly handle the inner header of network packets. This can lead to unauthorized access and manipulation of sensitive data. The issue is caused by the lack of initialization of certain variables, which can result in unexpected behavior. The pskb inet may pull() function is used to ensure that the necessary headers are present in the packet, but it does not properly handle the inner header. The vulnerability can be exploited by sending specially crafted packets to the affected system.Recommendations:
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu