CVE-2024-27417

MEDIUM

Linux kernel - Info Disclosure

Title source: llm

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount.

References (8)

[Patch] https://git.kernel.org/stable/c/10bfd453da64a057bcfd1a49fb6b271c48653cdb

[Patch] https://git.kernel.org/stable/c/1b0998fdd85776775d975d0024bca227597e836a

[Patch] https://git.kernel.org/stable/c/33a1b6bfef6def2068c8703403759024ce17053e

[Patch] https://git.kernel.org/stable/c/44112bc5c74e64f28f5a9127dc34066c7a09bd0f

[Patch] https://git.kernel.org/stable/c/810fa7d5e5202fcfb22720304b755f1bdfd4c174

[Patch] https://git.kernel.org/stable/c/8a54834c03c30e549c33d5da0975f3e1454ec906

[Patch] https://git.kernel.org/stable/c/9d4ffb5b9d879a75e4f7460e8b10e756b4dfb132

[Third Party Advisory] https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

Scores

CVSS v3 5.5

EPSS 0.0001

EPSS Percentile 1.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Classification

CWE

CWE-401

Status published

Affected Products (14)

linux/linux_kernel < 5.4.271

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

linux/linux_kernel

debian/debian_linux

linux/Kernel < 5.4.271linux

linux/Kernel < 5.10.212linux

linux/Kernel < 5.15.151linux

linux/Kernel < 6.1.81linux

linux/Kernel < 6.6.21linux

linux/Kernel < 6.7.9linux

Timeline

Published May 17, 2024

Tracked Since Feb 18, 2026