PT-2025-2832 · Linux+4 · Linux Kernel+4
Guangguan Wang
·
Published
2024-12-11
·
Updated
2026-05-26
·
CVE-2024-49568
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
The issue concerns the Linux kernel, specifically the net/smc component. When receiving a proposal message in the server, the fields
v2 ext offset, eid cnt, and ism gid cnt in the proposal message are from the remote client and cannot be fully trusted. Especially the field v2 ext offset, once it exceeds the maximum value, there is a chance to access the wrong address, and a crash may happen. This patch checks the fields v2 ext offset, eid cnt, and ism gid cnt before using them.Recommendations
For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider restricting access to the net/smc component until a patch is available.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Suse
Ubuntu