CVE-2024-27417

ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_getaddr() returns -EINVAL with an elevated "struct net" refcount.

N/A

CVSS

Severity:

EPSS 0.16%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/9d4ffb5b9d879a75e4f7460e8b10e756b4dfb132
https://git.kernel.org/stable/c/810fa7d5e5202fcfb22720304b755f1bdfd4c174
https://git.kernel.org/stable/c/8a54834c03c30e549c33d5da0975f3e1454ec906
https://git.kernel.org/stable/c/1b0998fdd85776775d975d0024bca227597e836a
https://git.kernel.org/stable/c/44112bc5c74e64f28f5a9127dc34066c7a09bd0f
https://git.kernel.org/stable/c/33a1b6bfef6def2068c8703403759024ce17053e
https://git.kernel.org/stable/c/10bfd453da64a057bcfd1a49fb6b271c48653cdb
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

Frequently Asked Questions

What is the severity of CVE-2024-27417?: CVE-2024-27417 has not yet been assigned a CVSS score.
How to fix CVE-2024-27417?: To fix CVE-2024-27417, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-27417 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-27417 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-27417?: CVE-2024-27417 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.