PT-2024-8501 · Linux+9 · Linux Kernel+9
Cosmin Ratiu
·
Published
2024-04-10
·
Updated
2025-09-29
·
CVE-2024-35960
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue is related to the incorrect initialization of resources in the
add rule fg() function, which can lead to a crash when the flow group is deleted. This happens because create flow handle tries to find and reference existing identical rules, while add rule fg only adds new rules with a refcount of 1 to the tree. As a result, a rule with a refcount of 2 may not be linked into the tree, causing a crash when del sw hw rule is invoked. This issue has been observed in the wild due to another bug related to incorrect handling of duplicate pkt reformat ids.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Improper Initialization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu