CVE-2024-38612: ipv6: sr: fix invalid unregister error path
In the Linux kernel, the following vulnerability has been resolved:
ipv6: sr: fix invalid unregister error path
The error path of seg6init() is wrong in case CONFIGIPV6SEG6LWTUNNEL is not defined. In that case if seg6hmacinit() fails, the genlunregisterfamily() isn't called.
This issue exist since commit 46738b1317e1 ("ipv6: sr: add option to control lwtunnel support"), and commit 5559cea2d5aa ("ipv6: sr: fix possible use-after-free and null-ptr-deref") replaced unregisterpernetsubsys() with genlunregisterfamily() in this error path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38612?
CVE-2024-38612 has a medium severity rating due to potential disruptions in network functionality.
How do I fix CVE-2024-38612?
To fix CVE-2024-38612, update to the patched Linux kernel versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which Linux kernels are affected by CVE-2024-38612?
CVE-2024-38612 affects certain versions of the Linux kernel prior to the patched releases mentioned in the solution.
What is the nature of the error in CVE-2024-38612?
CVE-2024-38612 involves an error path in the seg6_init() function when certain configurations are not defined.
Is CVE-2024-38612 specific to certain Linux distributions?
The vulnerability CVE-2024-38612 is associated with the Linux kernel package, commonly used across multiple distributions, including Debian.