CVE-2024-36903: ipv6: Fix potential uninit-value access in __ip6_make_skb()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix potential uninit-value access in ip6makeskb()
As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in ipmakeskb()") for IPv4, check FLOWIFLAGKNOWNNH on fl6->flowi6flags instead of testing HDRINCL on the socket to avoid a race condition which causes uninit-value access.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix potential uninit-value access in ip6makeskb()
The Linux kernel CVE team has assigned CVE-2024-36903 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024053036-CVE-2024-36903-4a60@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.31 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.10 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36903?
CVE-2024-36903 is categorized as a medium-severity vulnerability due to the potential for uninitialized value access.
How do I fix CVE-2024-36903?
To fix CVE-2024-36903, update your Linux kernel to versions 6.6.31, 6.8.10, 6.9, or any validated versions as per your distribution's guidelines.
Which Linux kernel versions are affected by CVE-2024-36903?
CVE-2024-36903 affects Linux kernel versions prior to 6.6.31, 6.8.10, and 6.9, as well as several other versions in the 4.x and 5.x series.
What impact does CVE-2024-36903 have on systems?
CVE-2024-36903 can potentially lead to exploitation through uninitialized memory access, which may result in application crashes or unexpected behavior.
Is there a workaround for CVE-2024-36903?
While the recommended approach is to update the kernel, temporarily limiting the use of IPv6 may reduce exposure until a patch is applied.