CVE-2024-26733: arp: Prevent overflow in arp_req_get().

Published Apr 3, 2024
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

arp: Prevent overflow in arpreqget().

syzkaller reported an overflown write in arpreqget(). [0]

When ioctl(SIOCGARP) is issued, arpreqget() looks up an neighbour entry and copies neigh->ha to struct arpreq.arpha.sadata.

The arpha here is struct sockaddr, not struct sockaddrstorage, so the sadata buffer is just 14 bytes.

In the splat below, 2 bytes are overflown to the next int field, arpflags. We initialise the field just after the memcpy(), so it's not a problem.

However, when dev->addrlen is greater than 22 (e.g. MAXADDRLEN), arpnetmask is overwritten, which could be set as htonl(0xFFFFFFFFUL) in arpioctl() before calling arpreqget().

To avoid the overflow, let's limit the max length of memcpy().

Note that commit b5f0de6df6dc ("net: dev: Convert sadata to flexible array in struct sockaddr") just silenced syzkaller.

[0]: memcpy: detected field-spanning write (size 16) of single field "r->arpha.sadata" at net/ipv4/arp.c:1128 (size 14) WARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arpreqget+0x411/0x4a0 net/ipv4/arp.c:1128 Modules linked in: CPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 RIP: 0010:arpreqget+0x411/0x4a0 net/ipv4/arp.c:1128 Code: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6 RSP: 0018:ffffc900050b7998 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001 RBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000 R13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010 FS: 00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: arpioctl+0x33f/0x4b0 net/ipv4/arp.c:1261 inetioctl+0x314/0x3a0 net/ipv4/afinet.c:981 sockdoioctl+0xdf/0x260 net/socket.c:1204 sockioctl+0x3ef/0x650 net/socket.c:1321 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:870 [inline] sesysioctl fs/ioctl.c:856 [inline] x64sysioctl+0x18e/0x220 fs/ioctl.c:856 dosyscallx64 arch/x86/entry/common.c:51 [inline] dosyscall64+0x37/0x90 arch/x86/entry/common.c:81 entrySYSCALL64afterhwframe+0x64/0xce RIP: 0033:0x7f172b262b8d Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIGRAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d RDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003 RBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000

Other sources

In the Linux kernel, the following vulnerability has been resolved:

arp: Prevent overflow in arpreqget().

syzkaller reported an overflown write in arpreqget(). [0]

When ioctl(SIOCGARP) is issued, arpreqget() looks up an neighbour entry and copies neigh->ha to struct arpreq.arpha.sadata.

The arpha here is struct sockaddr, not struct sockaddrstorage, so the sadata buffer is just 14 bytes.

In the splat below, 2 bytes are overflown to the next int field, arpflags. We initialise the field just after the memcpy(), so it's not a problem.

However, when dev->addrlen is greater than 22 (e.g. MAXADDRLEN), arpnetmask is overwritten, which could be set as htonl(0xFFFFFFFFUL) in arpioctl() before calling arpreqget().

To avoid the overflow, let's limit the max length of memcpy().

Note that commit b5f0de6df6dc ("net: dev: Convert sadata to flexible array in struct sockaddr") just silenced syzkaller.

[0]: memcpy: detected field-spanning write (size 16) of single field "r->arpha.sadata" at net/ipv4/arp.c:1128 (size 14) WARNING: CPU: 0 PID: 144638 at net/ipv4/arp.c:1128 arpreqget+0x411/0x4a0 net/ipv4/arp.c:1128 Modules linked in: CPU: 0 PID: 144638 Comm: syz-executor.4 Not tainted 6.1.74 #31 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-5 04/01/2014 RIP: 0010:arpreqget+0x411/0x4a0 net/ipv4/arp.c:1128 Code: fd ff ff e8 41 42 de fb b9 0e 00 00 00 4c 89 fe 48 c7 c2 20 6d ab 87 48 c7 c7 80 6d ab 87 c6 05 25 af 72 04 01 e8 5f 8d ad fb <0f> 0b e9 6c fd ff ff e8 13 42 de fb be 03 00 00 00 4c 89 e7 e8 a6 RSP: 0018:ffffc900050b7998 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff88803a815000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8641a44a RDI: 0000000000000001 RBP: ffffc900050b7a98 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 203a7970636d656d R12: ffff888039c54000 R13: 1ffff92000a16f37 R14: ffff88803a815084 R15: 0000000000000010 FS: 00007f172bf306c0(0000) GS:ffff88805aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f172b3569f0 CR3: 0000000057f12005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> arpioctl+0x33f/0x4b0 net/ipv4/arp.c:1261 inetioctl+0x314/0x3a0 net/ipv4/afinet.c:981 sockdoioctl+0xdf/0x260 net/socket.c:1204 sockioctl+0x3ef/0x650 net/socket.c:1321 vfsioctl fs/ioctl.c:51 [inline] dosysioctl fs/ioctl.c:870 [inline] sesysioctl fs/ioctl.c:856 [inline] x64sysioctl+0x18e/0x220 fs/ioctl.c:856 dosyscallx64 arch/x86/entry/common.c:51 [inline] dosyscall64+0x37/0x90 arch/x86/entry/common.c:81 entrySYSCALL64afterhwframe+0x64/0xce RIP: 0033:0x7f172b262b8d Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f172bf300b8 EFLAGS: 00000246 ORIGRAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f172b3abf80 RCX: 00007f172b262b8d RDX: 0000000020000000 RSI: 0000000000008954 RDI: 0000000000000003 RBP: 00007f172b2d3493 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f172b3abf80 R15: 00007f172bf10000 </TASK>

— NVD

In the Linux kernel, the following vulnerability has been resolved:

arp: Prevent overflow in arpreqget().

The Linux kernel CVE team has assigned CVE-2024-26733 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024040358-CVE-2024-26733-617f@gregkh/T

— Red Hat

Affected Software

253 affected componentsFixes available
IBM Security Verify Governance<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Software Stack<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager Virtual Appliance<=ISVG 10.0.2
IBM Security Verify Governance Identity Manager Container<=ISVG 10.0.2
Linux Linux kernel>=2.6.12<5.10.211
Linux Linux kernel>=5.11<5.15.150
Linux Linux kernel>=5.16<6.1.80
Linux Linux kernel>=6.2<6.6.19
Linux Linux kernel>=6.7<6.7.7
Linux Linux kernel=5.10.211
Linux Linux kernel=6.8-rc1
Linux Linux kernel=6.8-rc2
Linux Linux kernel=6.8-rc3
Linux Linux kernel=6.8-rc4
Linux Linux kernel=6.8-rc5
Debian Debian Linux=10.0
All of the following
NetApp A1k Firmware
NetApp A1k
All of the following
NetApp A70 Firmware
NetApp A70
All of the following
NetApp A90 Firmware
NetApp A90
All of the following
NetApp A700s Firmware
NetApp A700s
All of the following
NetApp 8300 Firmware
NetApp 8300
All of the following
NetApp 8700 Firmware
NetApp 8700
All of the following
NetApp A400 Firmware
NetApp A400
All of the following
NetApp C400 Firmware
NetApp C400
All of the following
NetApp A320 Firmware
NetApp A320
All of the following
NetApp A800 Firmware
NetApp A800
All of the following
NetApp C800 Firmware
NetApp C800
All of the following
NetApp A900 Firmware
NetApp A900
All of the following
NetApp 9500 Firmware
NetApp 9500
All of the following
NetApp C190 Firmware
NetApp C190
All of the following
NetApp A150 Firmware
NetApp A150
All of the following
NetApp A220 Firmware
NetApp A220
All of the following
NetApp Fas2720 Firmware
NetApp Fas2720
All of the following
NetApp Fas2750 Firmware
NetApp Fas2750
All of the following
NetApp Fas2820 Firmware
NetApp Fas2820
All of the following
NetApp A300 Firmware
NetApp A300
All of the following
NetApp 8200 Firmware
NetApp 8200
All of the following
NetApp A700 Firmware
NetApp A700
All of the following
NetApp 9000 Firmware
NetApp 9000
All of the following
NetApp H610c Firmware
NetApp H610c
All of the following
NetApp H610s Firmware
NetApp H610s
All of the following
NetApp H615c Firmware
NetApp H615c
NetApp E-Series SANtricity OS Controller>=11.0.0<=11.70.2
redhat/kernel<5.10.211
5.10.211
redhat/kernel<5.15.150
5.15.150
redhat/kernel<6.1.80
6.1.80
redhat/kernel<6.6.19
6.6.19
redhat/kernel<6.7.7
6.7.7
redhat/kernel<6.8
6.8
linux/kernel>=2.6.12<5.10.211
5.10.211
linux/kernel>=5.11.0<5.15.150
5.15.150
linux/kernel>=5.16.0<6.1.80
6.1.80
linux/kernel>=6.2.0<6.6.19
6.6.19
linux/kernel>=6.7.0<6.7.7
6.7.7
debian/linux<6.1.82-1
6.1.82-1
debian/linux<6.7.7-1
6.7.7-1
debian/linux<6.7.7-1
6.7.7-1
ubuntu/linux-aws<4.4.0-1136.142
4.4.0-1136.142
ubuntu/linux-azure<4.15.0-1181.196~14.04.1
4.15.0-1181.196~14.04.1
ubuntu/linux-lts-xenial<4.4.0-259.293~14.04.1
4.4.0-259.293~14.04.1
ubuntu/linux*
ubuntu/linux<4.4.0-259.293
4.4.0-259.293
ubuntu/linux-aws<4.4.0-1174.189
4.4.0-1174.189
ubuntu/linux-aws-hwe<4.15.0-1173.186~16.04.1
4.15.0-1173.186~16.04.1
ubuntu/linux-azure<4.15.0-1181.196~16.04.1
4.15.0-1181.196~16.04.1
ubuntu/linux-gcp<4.15.0-1166.183~16.04.1
4.15.0-1166.183~16.04.1
ubuntu/linux-hwe<4.15.0-229.241~16.04.1
4.15.0-229.241~16.04.1
ubuntu/linux-kvm<4.4.0-1137.147
4.4.0-1137.147
ubuntu/linux-oracle<4.15.0-1135.146~16.04.1
4.15.0-1135.146~16.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1105.112
4.4.0-1105.112
ubuntu/linux-fips*
ubuntu/linux<4.15.0-229.241
4.15.0-229.241
ubuntu/linux-aws<4.15.0-1173.186
4.15.0-1173.186
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-aws-5.4<5.4.0-1126.136~18.04.1
5.4.0-1126.136~18.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-4.15<4.15.0-1181.196
4.15.0-1181.196
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-5.4<5.4.0-1131.138~18.04.1
5.4.0-1131.138~18.04.1
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15<4.15.0-1166.183
4.15.0-1166.183
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-5.4<5.4.0-1130.139~18.04.1
5.4.0-1130.139~18.04.1
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-5.4<5.4.0-186.206~18.04.1
5.4.0-186.206~18.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-ibm-5.4<5.4.0-1073.78~18.04.1
5.4.0-1073.78~18.04.1
ubuntu/linux-kvm<4.15.0-1156.161
4.15.0-1156.161
ubuntu/linux-oem*
ubuntu/linux-oracle<4.15.0-1135.146
4.15.0-1135.146
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-oracle-5.4<5.4.0-1125.134~18.04.1
5.4.0-1125.134~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1110.122~18.04.1
5.4.0-1110.122~18.04.1
ubuntu/linux-aws-fips<4.15.0-2111.117
4.15.0-2111.117
ubuntu/linux-azure-fips<4.15.0-2090.96
4.15.0-2090.96
ubuntu/linux-fips<4.15.0-1127.138
4.15.0-1127.138
ubuntu/linux-gcp-fips<4.15.0-2074.79
4.15.0-2074.79
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-186.206
5.4.0-186.206
ubuntu/linux-aws<5.4.0-1126.136
5.4.0-1126.136
ubuntu/linux-aws-5.15<5.15.0-1063.69~20.04.1
5.15.0-1063.69~20.04.1
ubuntu/linux-azure<5.4.0-1131.138
5.4.0-1131.138
ubuntu/linux-azure-5.15<5.15.0-1065.74~20.04.1
5.15.0-1065.74~20.04.1
ubuntu/linux-bluefield<5.4.0-1086.93
5.4.0-1086.93
ubuntu/linux-gcp<5.4.0-1130.139
5.4.0-1130.139
ubuntu/linux-gcp-5.15<5.15.0-1062.70~20.04.1
5.15.0-1062.70~20.04.1
ubuntu/linux-gkeop<5.4.0-1093.97
5.4.0-1093.97
ubuntu/linux-gkeop-5.15<5.15.0-1046.53~20.04.1
5.15.0-1046.53~20.04.1
ubuntu/linux-hwe-5.15<5.15.0-113.123~20.04.1
5.15.0-113.123~20.04.1
ubuntu/linux-ibm<5.4.0-1073.78
5.4.0-1073.78
ubuntu/linux-ibm-5.15<5.15.0-1057.60~20.04.1
5.15.0-1057.60~20.04.1
ubuntu/linux-intel-iotg-5.15<5.15.0-1058.64~20.04.1
5.15.0-1058.64~20.04.1
ubuntu/linux-iot<5.4.0-1038.39
5.4.0-1038.39
ubuntu/linux-kvm<5.4.0-1114.121
5.4.0-1114.121
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-110.120~20.04.1
5.15.0-110.120~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1027.27~20.04.1
5.15.0-1027.27~20.04.1
ubuntu/linux-oracle<5.4.0-1125.134
5.4.0-1125.134
ubuntu/linux-oracle-5.15<5.15.0-1061.67~20.04.1
5.15.0-1061.67~20.04.1
ubuntu/linux-raspi<5.4.0-1110.122
5.4.0-1110.122
ubuntu/linux-riscv-5.15<5.15.0-1059.63~20.04.1
5.15.0-1059.63~20.04.1
ubuntu/linux-xilinx-zynqmp<5.4.0-1045.49
5.4.0-1045.49
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1126.136+fips2
5.4.0-1126.136+fips2
ubuntu/linux-azure-fips<5.4.0-1131.138+fips1
5.4.0-1131.138+fips1
ubuntu/linux-fips<5.4.0-1100.110
5.4.0-1100.110
ubuntu/linux-gcp-fips<5.4.0-1130.139+fips1
5.4.0-1130.139+fips1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-112.122
5.15.0-112.122
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1063.69
5.15.0-1063.69
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5<6.5.0-1023.23~22.04.1
6.5.0-1023.23~22.04.1
ubuntu/linux-azure<5.15.0-1066.75
5.15.0-1066.75
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5<6.5.0-1024.25~22.04.1
6.5.0-1024.25~22.04.1
ubuntu/linux-azure-fde<5.15.0-1067.76.1
5.15.0-1067.76.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1062.70
5.15.0-1062.70
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5<6.5.0-1024.26~22.04.1
6.5.0-1024.26~22.04.1
ubuntu/linux-gke<5.15.0-1060.66
5.15.0-1060.66
ubuntu/linux-gkeop<5.15.0-1046.53
5.15.0-1046.53
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5<6.5.0-44.44~22.04.1
6.5.0-44.44~22.04.1
ubuntu/linux-ibm<5.15.0-1056.59
5.15.0-1056.59
ubuntu/linux-intel-iotg<5.15.0-1058.64
5.15.0-1058.64
ubuntu/linux-kvm<5.15.0-1060.65
5.15.0-1060.65
ubuntu/linux-lowlatency<5.15.0-110.120
5.15.0-110.120
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5<6.5.0-44.44.1~22.04.1
6.5.0-44.44.1~22.04.1
ubuntu/linux-nvidia<5.15.0-1058.59
5.15.0-1058.59
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5<6.5.0-1023.24
6.5.0-1023.24
ubuntu/linux-nvidia-tegra<5.15.0-1026.26
5.15.0-1026.26
ubuntu/linux-nvidia-tegra-igx<5.15.0-1015.15
5.15.0-1015.15
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5<6.5.0-1027.28
6.5.0-1027.28
ubuntu/linux-oracle<5.15.0-1061.67
5.15.0-1061.67
ubuntu/linux-oracle-6.5<6.5.0-1026.26~22.04.1
6.5.0-1026.26~22.04.1
ubuntu/linux-raspi<5.15.0-1058.61
5.15.0-1058.61
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5<6.5.0-1017.18~22.04.1
6.5.0-1017.18~22.04.1
ubuntu/linux-xilinx-zynqmp<5.15.0-1030.34
5.15.0-1030.34
ubuntu/linux-bluefield<5.15.0-1044.46
5.15.0-1044.46
ubuntu/linux-intel-iot-realtime<5.15.0-1056.58
5.15.0-1056.58
ubuntu/linux-realtime<5.15.0-1064.72
5.15.0-1064.72
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips<5.15.0-1063.69+fips1
5.15.0-1063.69+fips1
ubuntu/linux-azure-fips<5.15.0-1065.74+fips1
5.15.0-1065.74+fips1
ubuntu/linux-fips<5.15.0-111.121+fips1
5.15.0-111.121+fips1
ubuntu/linux-gcp-fips<5.15.0-1062.70+fips1
5.15.0-1062.70+fips1
ubuntu/linux-raspi-realtime<6.8.0-2002.2
6.8.0-2002.2
debian/linux
6.1.176-16.1.190-16.12.107-16.12.116-17.2.15-17.3.3-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 5.10.211
  2. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 5.15.150
  3. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.1.80
  4. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.6.19
  5. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.7.7
  6. Upgrade

    Upgrade redhat/kernel to a version that resolves this vulnerability.

    Fixed in 6.8
  7. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 5.10.211
  8. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 5.15.150
  9. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.1.80
  10. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.6.19
  11. Upgrade

    Upgrade linux/Kernel to a version that resolves this vulnerability.

    Fixed in 6.7.7
  12. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.82-1
  13. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.7.7-1
  14. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1136.142
  15. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1181.196~14.04.1
  16. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-259.293~14.04.1
  17. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-259.293
  18. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1174.189
  19. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1173.186~16.04.1
  20. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1181.196~16.04.1
  21. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1166.183~16.04.1
  22. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-229.241~16.04.1
  23. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1137.147
  24. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1135.146~16.04.1
  25. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1105.112
  26. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-229.241
  27. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1173.186
  28. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1126.136~18.04.1
  29. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1181.196
  30. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1131.138~18.04.1
  31. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1166.183
  32. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1130.139~18.04.1
  33. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-186.206~18.04.1
  34. Upgrade

    Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1073.78~18.04.1
  35. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1156.161
  36. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1135.146
  37. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1125.134~18.04.1
  38. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1110.122~18.04.1
  39. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2111.117
  40. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2090.96
  41. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1127.138
  42. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2074.79
  43. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-186.206
  44. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1126.136
  45. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1063.69~20.04.1
  46. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1131.138
  47. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1065.74~20.04.1
  48. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1086.93
  49. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1130.139
  50. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1062.70~20.04.1
  51. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.4.0-1093.97
  52. Upgrade

    Upgrade ubuntu/linux-gkeop-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1046.53~20.04.1
  53. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-113.123~20.04.1
  54. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1073.78
  55. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1057.60~20.04.1
  56. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1058.64~20.04.1
  57. Upgrade

    Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.

    Fixed in 5.4.0-1038.39
  58. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1114.121
  59. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-110.120~20.04.1
  60. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1027.27~20.04.1
  61. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1125.134
  62. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1061.67~20.04.1
  63. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1110.122
  64. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1059.63~20.04.1
  65. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1045.49
  66. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1126.136+fips2
  67. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1131.138+fips1
  68. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1100.110
  69. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1130.139+fips1
  70. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-112.122
  71. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1063.69
  72. Upgrade

    Upgrade ubuntu/linux-aws-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-1023.23~22.04.1
  73. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1066.75
  74. Upgrade

    Upgrade ubuntu/linux-azure-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-1024.25~22.04.1
  75. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1067.76.1
  76. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1062.70
  77. Upgrade

    Upgrade ubuntu/linux-gcp-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-1024.26~22.04.1
  78. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1060.66
  79. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1046.53
  80. Upgrade

    Upgrade ubuntu/linux-hwe-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-44.44~22.04.1
  81. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1056.59
  82. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1058.64
  83. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1060.65
  84. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-110.120
  85. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-44.44.1~22.04.1
  86. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1058.59
  87. Upgrade

    Upgrade ubuntu/linux-nvidia-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-1023.24
  88. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1026.26
  89. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1015.15
  90. Upgrade

    Upgrade ubuntu/linux-oem-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-1027.28
  91. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1061.67
  92. Upgrade

    Upgrade ubuntu/linux-oracle-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-1026.26~22.04.1
  93. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1058.61
  94. Upgrade

    Upgrade ubuntu/linux-starfive-6.5 to a version that resolves this vulnerability.

    Fixed in 6.5.0-1017.18~22.04.1
  95. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1030.34
  96. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1044.46
  97. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1056.58
  98. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1064.72
  99. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1063.69+fips1
  100. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1065.74+fips1
  101. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-111.121+fips1
  102. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.15.0-1062.70+fips1
  103. Upgrade

    Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.0-2002.2
  104. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1
  105. Compensating control

    In arp_req_get(), limit the memcpy() length when copying neigh->ha to struct arpreq.arp_ha.sa_data so it does not exceed the 14-byte sa_data buffer.

Event History

Apr 3, 2024
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
via OSV·05:00 PM
DescriptionAffected Software
Event
via OSV·05:15 PM
Data Sourced
via NVD·05:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Apr 4, 2024
Data Sourced
via Red Hat·01:12 AM
DescriptionSeverityAffected Software
Nov 6, 2026
Data Sourced
via OSV·01:50 PM
Severity

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2024-26733?

CVE-2024-26733 is classified as a high-severity vulnerability due to the potential for overflow issues in the Linux kernel.

2

How do I fix CVE-2024-26733?

To fix CVE-2024-26733, update your Linux kernel to the latest version recommended by your distribution, such as 5.10.211, 5.15.150, 6.1.80, or versions later than 6.8.

3

Which systems are affected by CVE-2024-26733?

CVE-2024-26733 affects various versions of the Linux kernel, including specific versions from both Red Hat and Debian.

4

When was CVE-2024-26733 reported?

CVE-2024-26733 was reported in 2024 and is tied to the functionality of the arp_req_get() in the Linux kernel.

5

What impact does CVE-2024-26733 have on systems?

The impact of CVE-2024-26733 can allow an attacker to exploit an overflow vulnerability, potentially leading to kernel crashes or arbitrary code execution.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203