In the Linux kernel, the following vulnerability has been resolved:
ipv4: Handle attempt to delete multipath route when fib_info contains an nh reference
Gwangun Jung reported a slab-out-of-bounds access in fib_nh_match:
fib_nh_match+0xf98/0x1130 linux-6.0-rc7/net/ipv4/fib_semantics.c:961
fib_table_delete+0x5f3/0xa40 linux-6.0-rc7/net/ipv4/fib_trie.c:1753
inet_rtm_delroute+0x2b3/0x380 linux-6.0-rc7/net/ipv4/fib_frontend.c:874
Separate nexthop objects are mutually exclusive with the legacy
multipath spec. Fix fib_nh_match to return if the config for the
to be deleted route contains a multipath spec while the fib_info
is using a nexthop object.
References
Configurations
Configuration 1 (hide)
|
History
31 Oct 2024, 14:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/0b5394229ebae09afc07aabccb5ffd705ffd250e - Patch | |
| References | () https://git.kernel.org/stable/c/25174d91e4a32a24204060d283bd5fa6d0ddf133 - Patch | |
| References | () https://git.kernel.org/stable/c/61b91eb33a69c3be11b259c5ea484505cd79f883 - Patch | |
| References | () https://git.kernel.org/stable/c/bb20a2ae241be846bc3c11ea4b3a3c69e41d51f2 - Patch | |
| References | () https://git.kernel.org/stable/c/cc3cd130ecfb8b0ae52e235e487bae3f16a24a32 - Patch | |
| CWE | CWE-125 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.1 |
| First Time |
Linux
Linux linux Kernel |
|
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
23 Oct 2024, 15:13
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
21 Oct 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-10-21 20:15
Updated : 2024-10-31 14:44
NVD link : CVE-2022-48999
Mitre link : CVE-2022-48999
CVE.ORG link : CVE-2022-48999
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-125
Out-of-bounds Read