PT-2024-36960 · Linux+7 · Linux Kernel+7
Syzbot
·
Published
2024-11-28
·
Updated
2025-11-18
·
CVE-2024-56650
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
A vulnerability has been resolved in the Linux kernel, specifically in the netfilter: x tables module, where an invalid byte sequence may be passed from userspace, potentially leading to a slab-out-of-bounds error in the
strlen function. The led tg check function has been updated to include an extra check to ensure that such sequences are rejected as possible IDs and never passed to kstrdup or further. The issue was reported by Syzbot and detected by KASAN.Recommendations
To resolve the issue, update to Linux kernel version 6.6.74 or later. As a temporary workaround, consider restricting access to the vulnerable
led tg check function until a patch is available. Avoid using the kstrdup function with unvalidated user input in the affected API endpoint until the issue is resolved.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu