SB2024061024 - Use-after-free in Linux kernel net 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024061024

SB2024061024 - Use-after-free in Linux kernel net

Published: June 10, 2024 Updated: August 5, 2024

Security Bulletin ID SB2024061024
Severity
Critical
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Critical 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Use-after-free (CVE-ID: CVE-2024-36971)

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to a use-after-free error within the xfrm_link_failure() function in net/xfrm/xfrm_policy.c, within the dst_entry ip6_dst_check() and ip6_dst_check() functions in net/ipv6/route.c, within the dst_entry ipv4_dst_check() and ip_do_redirect() functions in net/ipv4/route.c. A remote attacker can send specially crafted packets to the system and execute arbitrary code.

Note, the vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

References