CVE-2024-44944 netfilter: ctnetlink: use helper function to calculate expect ID
A missing helper function in the Linux kernel netfilter subsystem leaks the least significant bit of an expectation object address to userspace.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-44944?
CVE-2024-44944 is a medium-severity vulnerability in Linux kernel, published on 30 Aug 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: use helper function to calculate expect ID
Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise LSB of the expectation object address is leaked to userspace.
Weakness: CWE-401
Which versions are affected by CVE-2024-44944?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-44944?
Apply the vendor's patch.
Is CVE-2024-44944 being exploited?
There is no known exploitation of CVE-2024-44944 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-48474, BELL-CVE-2024-44944, DEBIAN-CVE-2024-44944, GHSA-xq7r-x85c-27jm, UBUNTU-CVE-2024-44944.