CVE-2024-46677

gtp: fix a potential NULL pointer dereference

Description

In the Linux kernel, the following vulnerability has been resolved: gtp: fix a potential NULL pointer dereference When sockfd_lookup() fails, gtp_encap_enable_socket() returns a NULL pointer, but its callers only check for error pointers thus miss the NULL pointer case. Fix it by returning an error pointer with the error code carried from sockfd_lookup(). (I found this bug during code inspection.)

Category

5.5
CVSS
Severity: Medium
CVSS 3.1 •
EPSS 0.07%
Affected: Linux Linux
Affected: Linux Linux
Published at:
Updated at:

References

Link Tags
https://git.kernel.org/stable/c/620fe9809752fae91b4190e897b81ed9976dfb39 patch
https://git.kernel.org/stable/c/bdd99e5f0ad5fa727b16f2101fe880aa2bff2f8e patch
https://git.kernel.org/stable/c/8bbb9e4e0e66a39282e582d0440724055404b38c patch
https://git.kernel.org/stable/c/4643b91691e969b1b9ad54bf552d7a990cfa3b87 patch
https://git.kernel.org/stable/c/e8b9930b0eb045d19e883c65ff9676fc89320c70 patch
https://git.kernel.org/stable/c/28c67f0f84f889fe9f4cbda8354132b20dc9212d patch
https://git.kernel.org/stable/c/612edd35f2a3910ab1f61c1f2338889d4ba99fa2 patch
https://git.kernel.org/stable/c/defd8b3c37b0f9cb3e0f60f47d3d78d459d57fda patch

Frequently Asked Questions

What is the severity of CVE-2024-46677?
CVE-2024-46677 has been scored as a medium severity vulnerability.
How to fix CVE-2024-46677?
To fix CVE-2024-46677, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-46677 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-46677 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-46677?
CVE-2024-46677 affects Linux Linux, Linux Linux.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.