PT-2024-6076 · Linux+4 · Linux Kernel+4

Horatiu Vultur · Published 2024-02-09 · Updated 2024-10-22 · CVE-2024-26723

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a crash when adding a lan966x interface under a lag interface in the Linux kernel. This can be reproduced by running specific commands, such as "ip link add name bond0 type bond miimon 100 mode balance-xor" and "ip link set dev eth0 master bond0". The reason for the crash is that the lan966x can have ports that are NULL pointers as they are not probed, causing the system to crash when iterating over these ports. The fix involves checking for NULL pointers before accessing something from the ports.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2024-06901

CVE-2024-26723

DSA-5658-1

USN-6895-1

USN-6895-2

USN-6895-3

USN-6895-4

USN-6900-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 142

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26723.json · Exploit
• https://ubuntu.com/security/CVE-2023-52642 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26733 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26643 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26698 · Vendor Advisory
• https://git.kernel.org/stable/c/b9357489c46c7a43999964628db8b47d3a1f8672 · Patch
• https://ubuntu.com/security/CVE-2024-26920 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26601 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26824 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26708 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26702 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26693 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6895-3 · Vendor Advisory
• https://git.kernel.org/stable/c/15faa1f67ab405d47789d4702f587ec7df7ef03e · Patch
• https://ubuntu.com/security/CVE-2024-26602 · Vendor Advisory