CVE-2024-26849 netlink: add nla be16/32 types to minlen array
A missing validation check in the Linux kernel netlink subsystem allows attackers to read uninitialized memory, potentially disclosing sensitive kernel data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26849?
CVE-2024-26849 is a medium-severity vulnerability in Linux kernel, published on 17 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netlink: add nla be16/32 types to minlen array
BUG: KMSAN: uninit-value in nla_validate_range_unsigned lib/nlattr.c:222 [inline] BUG: KMSAN: uninit-value in nla_validate_int_range lib/nlattr.c:336 [inline] BUG: KMSAN: uninit-value in validate_nla lib/nlattr.c:575 [inline] BUG: KMSAN: uninit-value in __nla_validate_parse+0x2e20/0x45c0 lib/nlattr.c:631 nla_validate_range_unsigned lib/nlattr.c:222 [inline] nla_validate_int_range lib/nlattr.c:336 [inline] validate_nla lib/nlattr.c:575 [inline] ...
The message in question matches this policy:
[NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255),
but because NLA_BE32 size in minlen array is 0, the validation code will read past the malformed (too small) attribute.
Note: Other attributes, e.g. BITFIELD32, SINT, UINT.. are also missing: those likely should be added too.
Weakness: CWE-908
Which versions are affected by CVE-2024-26849?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-26849?
Apply the vendor's patch.
Is CVE-2024-26849 being exploited?
There is no known exploitation of CVE-2024-26849 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-26849, DEBIAN-CVE-2024-26849, GHSA-9vx2-7qpg-xf7m, UBUNTU-CVE-2024-26849.