THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2024-26641 (HIGH 8.6) — In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this cal

[NVD] CVE-2024-26641 (HIGH 8.6) — In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this cal

lownvdPublished 2024-03-18

CVE-2024-26641 CVSS: 8.6 HIGH Published: 2024-03-18T11:15:11.193

In the Linux kernel, the following vulnerability has been resolved:

ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()

syzbot found __ip6_tnl_rcv() could access unitiliazed data [1].

Call pskb_inet_may_pull() to fix this, and initialize ipv6h variable after this call as it can change skb->head.

[1] BUG: KMSAN: uninit

Indicators of compromise

CVE-2024-26641cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2024-26641