IM
IronMonkey Threat Research

CVE-2024-44944 MEDIUM

Published: 2024-08-30 | Last Modified: 2026-05-12 | Status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace.

Additional Descriptions (1)

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: ctnetlink: usar la función auxiliar para calcular el ID de expectativa. Al eliminar la ruta de expectativa falta una llamada a la función auxiliar nf_expect_get_id() para calcular el ID de expectativa; de lo contrario, el LSB de la dirección del objeto de expectativa se filtra al espacio de usuario.

CVSS Metrics

Base Score: 5.5 (MEDIUM)

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.8

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Primary
en CWE-401

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd349465780> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd349464140> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3842b4940> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd3494673c0> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd349465540> Operating System
linux linux_kernel * <built-in method update of dict object at 0x7fd349464540> Operating System
linux linux_kernel 4.19.320 <built-in method update of dict object at 0x7fd349464b40> Operating System
linux linux_kernel 5.1 <built-in method update of dict object at 0x7fd3842b6400> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:4.19.320:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:5.1:*:*:*:*:*:*:*

References