CVE-2024-27418: net: mctp: take ownership of skb in mctp_local_output
In the Linux kernel, the following vulnerability has been resolved:
net: mctp: take ownership of skb in mctplocaloutput
Currently, mctplocaloutput only takes ownership of skb on success, and we may leak an skb if mctplocaloutput fails in specific states; the skb ownership isn't transferred until the actual output routing occurs.
Instead, make mctplocaloutput free the skb on all error paths up to the route action, so it always consumes the passed skb.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27418?
CVE-2024-27418 is classified as a moderate severity vulnerability due to potential memory leaks in the Linux kernel.
How do I fix CVE-2024-27418?
To fix CVE-2024-27418, update your Linux kernel to the latest version available for your distribution that includes the patch.
What versions of the Linux kernel are affected by CVE-2024-27418?
CVE-2024-27418 affects earlier versions of the Linux kernel prior to the release that addresses this specific vulnerability.
What is the impact of CVE-2024-27418?
The impact of CVE-2024-27418 includes the potential for memory leaks which may lead to resource exhaustion on affected systems.
Is CVE-2024-27418 exploitable remotely?
CVE-2024-27418 is not considered to be remotely exploitable as it requires specific local conditions to cause the vulnerability.