CVE-2024-40985: net/tcp_ao: Don't leak ao_info on error-path
In the Linux kernel, the following vulnerability has been resolved:
net/tcpao: Don't leak aoinfo on error-path
It seems I introduced it together with TCPAOCMDFAOREQUIRED, on version 5 [1] of TCP-AO patches. Quite frustrative that having all these selftests that I've written, running kmemtest & kcov was always in todo.
[1]: https://lore.kernel.org/netdev/20230215183335.800122-5-dima@arista.com/
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40985?
CVE-2024-40985 has a moderate severity level due to potential information leakage on error paths in the Linux kernel.
How do I fix CVE-2024-40985?
To fix CVE-2024-40985, upgrade to the patched versions of the Linux kernel, specifically 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
Which versions of Linux are affected by CVE-2024-40985?
CVE-2024-40985 affects the Linux kernel versions prior to the patches including 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, and 6.12.12-1.
What component of the Linux kernel is impacted by CVE-2024-40985?
CVE-2024-40985 impacts the TCP-AO implementation in the net/tcp_ao component of the Linux kernel.
Is CVE-2024-40985 related to any specific functionality in Linux?
Yes, CVE-2024-40985 is specifically related to error handling in TCP-AO, which can lead to unintended information leakage.