CVE-2024-42154

MEDIUM

Linux Kernel 3.14-6.9.8 - DoS via TCP Metrics Source Address Validation

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated).

References (13)

Core 13
Core References

Scores

CVSS v3 4.4
EPSS 0.0026
EPSS Percentile 16.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-754
Status published
Products (27)
linux/Kernel 3.14.0 - 4.19.318linux
linux/Kernel 4.20.0 - 5.4.280linux
linux/Kernel 5.11.0 - 5.15.163linux
linux/Kernel 5.16.0 - 6.1.98linux
linux/Kernel 5.5.0 - 5.10.222linux
linux/Kernel 6.2.0 - 6.6.39linux
linux/Kernel 6.7.0 - 6.9.9linux
Linux/Linux < 3.14
Linux/Linux 3.14
Linux/Linux 3e7013ddf55af7bc191792b8aea0c2b94fb0fef5 - 19d997b59fa1fd7a02e770ee0881c0652b9c32c9
... and 17 more
Published Jul 30, 2024
Tracked Since Feb 18, 2026