CVE-2024-35982

{"id": "CVE-2024-35982", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.4}]}, "published": "2024-05-20T10:15:12.687", "references": [{"url": "https://git.kernel.org/stable/c/04720ea2e6c64459a90ca28570ea78335eccd924", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3fe79b2c83461edbbf86ed8a6f3924820ff89259", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4ca2a5fb54ea2cc43edea614207fcede562d91c2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/70a8be9dc2fb65d67f8c1e0c88c587e08e2e575d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/87b6af1a7683e021710c08fc0551fc078346032f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b1f532a3b1e6d2e5559c7ace49322922637a28aa", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b3ddf6904073990492454b1dd1c10a24be8c74c6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ca54e2671548616ad34885f90d4f26f7adb088f0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-835"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: Avoid infinite loop trying to resize local TT\n\nIf the MTU of one of an attached interface becomes too small to transmit\nthe local translation table then it must be resized to fit inside all\nfragments (when enabled) or a single packet.\n\nBut if the MTU becomes too low to transmit even the header + the VLAN\nspecific part then the resizing of the local TT will never succeed. This\ncan for example happen when the usable space is 110 bytes and 11 VLANs are\non top of batman-adv. In this case, at least 116 byte would be needed.\nThere will just be an endless spam of\n\n batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)\n\nin the log but the function will never finish. Problem here is that the\ntimeout will be halved all the time and will then stagnate at 0 and\ntherefore never be able to reduce the table even more.\n\nThere are other scenarios possible with a similar result. The number of\nBATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too\nhigh to fit inside a packet. Such a scenario can therefore happen also with\nonly a single VLAN + 7 non-purgable addresses - requiring at least 120\nbytes.\n\nWhile this should be handled proactively when:\n\n* interface with too low MTU is added\n* VLAN is added\n* non-purgeable local mac is added\n* MTU of an attached interface is reduced\n* fragmentation setting gets disabled (which most likely requires dropping\n attached interfaces)\n\nnot all of these scenarios can be prevented because batman-adv is only\nconsuming events without the the possibility to prevent these actions\n(non-purgable MAC address added, MTU of an attached interface is reduced).\nIt is therefore necessary to also make sure that the code is able to handle\nalso the situations when there were already incompatible system\nconfiguration are present."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: batman-adv: Evite el bucle infinito al intentar cambiar el tama\u00f1o del TT local. Si la MTU de una de las interfaces conectadas se vuelve demasiado peque\u00f1a para transmitir la tabla de traducci\u00f3n local, entonces se debe cambiar su tama\u00f1o para que quepa dentro. todos los fragmentos (cuando est\u00e1 habilitado) o un solo paquete. Pero si la MTU es demasiado baja para transmitir incluso el encabezado + la parte espec\u00edfica de la VLAN, entonces el cambio de tama\u00f1o del TT local nunca tendr\u00e1 \u00e9xito. Esto puede suceder, por ejemplo, cuando el espacio utilizable es de 110 bytes y hay 11 VLAN encima de batman-adv. En este caso, se necesitar\u00edan al menos 116 bytes. Simplemente habr\u00e1 un spam interminable de batman_adv: batadv0: Obligado a purgar las entradas tt locales para ajustar el nuevo fragmento m\u00e1ximo MTU (110) en el registro, pero la funci\u00f3n nunca finalizar\u00e1. El problema aqu\u00ed es que el tiempo de espera se reducir\u00e1 a la mitad todo el tiempo y luego se estancar\u00e1 en 0 y, por lo tanto, nunca podr\u00e1 reducir la tabla a\u00fan m\u00e1s. Hay otros escenarios posibles con un resultado similar. El n\u00famero de entradas BATADV_TT_CLIENT_NOPURGE en el TT local puede, por ejemplo, ser demasiado alto para caber dentro de un paquete. Por lo tanto, este escenario puede ocurrir tambi\u00e9n con una sola VLAN + 7 direcciones no purgables, lo que requiere al menos 120 bytes. Si bien esto debe manejarse de manera proactiva cuando: * se agrega una interfaz con una MTU demasiado baja * se agrega una VLAN * se agrega una mac local no purgable * se reduce la MTU de una interfaz conectada * la configuraci\u00f3n de fragmentaci\u00f3n se desactiva (lo que probablemente requiera eliminar las interfaces conectadas) No todos estos escenarios se pueden prevenir porque batman-adv solo consume eventos sin la posibilidad de evitar estas acciones (se agrega una direcci\u00f3n MAC no purgable, se reduce la MTU de una interfaz adjunta). Por lo tanto, tambi\u00e9n es necesario asegurarse de que el c\u00f3digo sea capaz de manejar tambi\u00e9n las situaciones en las que ya hab\u00eda una configuraci\u00f3n del sistema incompatible."}], "lastModified": "2024-07-03T02:02:32.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22DD99BA-225B-49F6-AD13-22F00AEDE90F", "versionEndExcluding": "4.19.313", "versionStartIncluding": "3.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FF6D8DE-C559-4586-86C8-2C6B4420A2C2", "versionEndExcluding": "5.4.275", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A44ABF89-F1BD-4C9A-895D-7596650DCD27", "versionEndExcluding": "5.10.216", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E80AFAB4-A9F3-415C-8D6C-52D1C13F1531", "versionEndExcluding": "5.15.156", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDA59296-EDB8-44CD-98E4-C08C051569E6", "versionEndExcluding": "6.1.87", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D6315B0-B3BA-406C-B0DB-51D9A63753F0", "versionEndExcluding": "6.6.28", "versionStartIncluding": "6.2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "531BDFB5-EF6A-4707-902E-146368303499", "versionEndExcluding": "6.8.7", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}