CVE-2024-27417: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix potential "struct net" leak in inet6rtmgetaddr()
It seems that if userspace provides a correct IFATARGETNETNSID value but no IFAADDRESS and IFALOCAL attributes, inet6rtmgetaddr() returns -EINVAL with an elevated "struct net" refcount.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix potential "struct net" leak in inet6rtmgetaddr()
The Linux kernel CVE team has assigned CVE-2024-27417 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051703-CVE-2024-27417-3841@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27417?
CVE-2024-27417 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-27417?
To fix CVE-2024-27417, users should update to the patched kernel versions provided by their Linux distribution.
Which Linux kernel versions are affected by CVE-2024-27417?
CVE-2024-27417 affects various versions including those below 5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9, and 6.8.
What does CVE-2024-27417 specifically address?
CVE-2024-27417 addresses a potential 'struct net' leak in the ipv6 function inet6_rtm_getaddr() in the Linux kernel.
Is CVE-2024-27417 present in Red Hat or Debian kernels?
Yes, CVE-2024-27417 is present in specific versions of the kernel packages for both Red Hat and Debian.