CVE-2024-26849: netlink: add nla be16/32 types to minlen array
First published: Wed Apr 17 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: netlink: add nla be16/32 types to minlen array BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline] BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631 nla_validate_range_unsigned lib/nlattr.c:222 [inline] nla_validate_int_range lib/nlattr.c:336 [inline] validate_nla lib/nlattr.c:575 [inline] ... The message in question matches this policy: [NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255), but because NLA_BE32 size in minlen array is 0, the validation code will read past the malformed (too small) attribute. Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing: those likely should be added too.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| Linux Kernel | >=6.1<6.1.81 | |
| Linux Kernel | >=6.2<6.6.21 | |
| Linux Kernel | >=6.7<6.7.9 | |
| Linux Kernel | =6.8-rc1 | |
| Linux Kernel | =6.8-rc2 | |
| Linux Kernel | =6.8-rc3 | |
| Linux Kernel | =6.8-rc4 | |
| Linux Kernel | =6.8-rc5 | |
| Linux Kernel | =6.8-rc6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-26849?
The severity level of CVE-2024-26849 has not been explicitly stated, but it is related to uninitialized values in the Linux kernel, which could lead to security implications.
How do I fix CVE-2024-26849?
To fix CVE-2024-26849, update the Linux kernel to a version that includes the patch for this vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-26849?
CVE-2024-26849 affects various versions of the Linux kernel, specifically versions between 6.1 and 6.8-rc6.
What kind of issue does CVE-2024-26849 represent in the Linux kernel?
CVE-2024-26849 represents a vulnerability involving uninitialized values in netlink attribute validation within the Linux kernel.
Is CVE-2024-26849 classified as a critical vulnerability?
CVE-2024-26849 is concerning due to its potential to impact system integrity, but it is important to verify its classification based on the specific context of its usage.
- agent/references
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/severity
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/softwarecombine
- agent/event
- agent/tags
- vendor/linux
- canonical/linux kernel
- version/linux kernel/6.1
- version/linux kernel/6.2
- version/linux kernel/6.7
- version/linux kernel/6.8-rc1
- version/linux kernel/6.8-rc2
- version/linux kernel/6.8-rc3
- version/linux kernel/6.8-rc4
- version/linux kernel/6.8-rc5
- version/linux kernel/6.8-rc6