CVE-2024-50168: net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
In the Linux kernel, the following vulnerability has been resolved:
net/sun382586: fix potential memory leak in sun382586sendpacket()
The sun382586sendpacket() returns NETDEVTXOK without freeing skb in case of skb->len being too long, add devkfreeskb() to fix it.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.15.173.1-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.64.2-1 - Configuration
Update the net/sun3_82586 driver logic so that sun3_82586_send_packet() frees the skb (dev_kfree_skb()) when skb->len is too long; avoid returning NETDEV_TX_OK without freeing the skb.
Linux kernel net/sun3_82586 sun3_82586_send_packet() skb->len-too-long handling = Call dev_kfree_skb() when skb->len is too long instead of returning NETDEV_TX_OK without freeing skb
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50168?
CVE-2024-50168 has been classified as a moderate severity vulnerability affecting the Linux kernel.
How do I fix CVE-2024-50168?
To fix CVE-2024-50168, ensure you update your Linux kernel to a version that includes the patch for this vulnerability.
Which Linux kernel versions are affected by CVE-2024-50168?
CVE-2024-50168 affects several Linux kernel versions ranging from 2.6.12 to 6.12-rc4.
What component is impacted by CVE-2024-50168?
CVE-2024-50168 impacts the networking component in the Linux kernel related to the sun3_82586 driver.
What is the nature of the vulnerability in CVE-2024-50168?
CVE-2024-50168 is a memory leak vulnerability caused by the sun3_82586_send_packet() function not freeing the skb in certain conditions.