CVE-2024-49568

net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg

Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field v2_ext_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen. This patch checks the fields v2_ext_offset/eid_cnt/ism_gid_cnt before using them.

N/A

CVSS

Severity:

EPSS 0.04%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/295a92e3df32e72aff0f4bc25c310e349d07ffbf
https://git.kernel.org/stable/c/42f6beb2d5779429417b5f8115a4e3fa695d2a6c
https://git.kernel.org/stable/c/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf

Frequently Asked Questions

What is the severity of CVE-2024-49568?: CVE-2024-49568 has not yet been assigned a CVSS score.
How to fix CVE-2024-49568?: To fix CVE-2024-49568, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-49568 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2024-49568 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-49568?: CVE-2024-49568 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.