CVE-2024-44944

MEDIUM

Linux Kernel - Use-After-Free in Netfilter Expectation Deletion

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace.

References (15)

Core 15
Core References

Scores

CVSS v3 5.5
EPSS 0.0024
EPSS Percentile 14.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-401
Status published
Products (39)
linux/Kernel < 4.19.320linux
linux/Kernel 4.20.0 - 5.4.282linux
linux/Kernel 5.1.0 - 5.10.224linux
linux/Kernel 5.11.0 - 6.1.103linux
linux/Kernel 5.16.0 - 6.6.44linux
linux/Kernel 5.5.0 - 5.15.165linux
linux/Kernel 6.2.0 - 6.10.3linux
Linux/Linux < 5.1
Linux/Linux 1922476beeeea46bebbe577215078736dd4231dc
Linux/Linux 3.16.72 - 3.17
... and 29 more
Published Aug 30, 2024
Tracked Since Feb 18, 2026