cve-2024-26752
Vulnerability from cvelistv5
Published
2024-04-03 17:00
Modified
2024-08-02 00:14
Severity
Summary
l2tp: pass correct message length to ip6_append_data
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26752",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T18:05:57.024676Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:48:58.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.330Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/l2tp/l2tp_ip6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4c3ce64bc9d3",
              "status": "affected",
              "version": "559d697c5d07",
              "versionType": "git"
            },
            {
              "lessThan": "c1d3a84a67db",
              "status": "affected",
              "version": "1fc793d68d50",
              "versionType": "git"
            },
            {
              "lessThan": "dcb4d1426859",
              "status": "affected",
              "version": "96b2e1090397",
              "versionType": "git"
            },
            {
              "lessThan": "0da15a703951",
              "status": "affected",
              "version": "cd1189956393",
              "versionType": "git"
            },
            {
              "lessThan": "13cd1daeea84",
              "status": "affected",
              "version": "f6a7182179c0",
              "versionType": "git"
            },
            {
              "lessThan": "804bd8650a3a",
              "status": "affected",
              "version": "9d4c75800f61",
              "versionType": "git"
            },
            {
              "lessThan": "83340c66b498",
              "status": "affected",
              "version": "9d4c75800f61",
              "versionType": "git"
            },
            {
              "lessThan": "359e54a93ab4",
              "status": "affected",
              "version": "9d4c75800f61",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/l2tp/l2tp_ip6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.308",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.270",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.211",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nl2tp: pass correct message length to ip6_append_data\n\nl2tp_ip6_sendmsg needs to avoid accounting for the transport header\ntwice when splicing more data into an already partially-occupied skbuff.\n\nTo manage this, we check whether the skbuff contains data using\nskb_queue_empty when deciding how much data to append using\nip6_append_data.\n\nHowever, the code which performed the calculation was incorrect:\n\n     ulen = len + skb_queue_empty(\u0026sk-\u003esk_write_queue) ? transhdrlen : 0;\n\n...due to C operator precedence, this ends up setting ulen to\ntranshdrlen for messages with a non-zero length, which results in\ncorrupted packets on the wire.\n\nAdd parentheses to correct the calculation in line with the original\nintent."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:22:06.570Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243"
        },
        {
          "url": "https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d"
        },
        {
          "url": "https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500"
        },
        {
          "url": "https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56"
        },
        {
          "url": "https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
        },
        {
          "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
        }
      ],
      "title": "l2tp: pass correct message length to ip6_append_data",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26752",
    "datePublished": "2024-04-03T17:00:37.340Z",
    "dateReserved": "2024-02-19T14:20:24.169Z",
    "dateUpdated": "2024-08-02T00:14:13.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26752\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:51.910\",\"lastModified\":\"2024-06-27T12:15:20.473\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nl2tp: pass correct message length to ip6_append_data\\n\\nl2tp_ip6_sendmsg needs to avoid accounting for the transport header\\ntwice when splicing more data into an already partially-occupied skbuff.\\n\\nTo manage this, we check whether the skbuff contains data using\\nskb_queue_empty when deciding how much data to append using\\nip6_append_data.\\n\\nHowever, the code which performed the calculation was incorrect:\\n\\n     ulen = len + skb_queue_empty(\u0026sk-\u003esk_write_queue) ? transhdrlen : 0;\\n\\n...due to C operator precedence, this ends up setting ulen to\\ntranshdrlen for messages with a non-zero length, which results in\\ncorrupted packets on the wire.\\n\\nAdd parentheses to correct the calculation in line with the original\\nintent.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: l2tp: pasa la longitud correcta del mensaje a ip6_append_data l2tp_ip6_sendmsg necesita evitar tener en cuenta el encabezado de transporte dos veces al unir m\u00e1s datos en un skbuff ya parcialmente ocupado. Para gestionar esto, verificamos si skbuff contiene datos usando skb_queue_empty al decidir cu\u00e1ntos datos agregar usando ip6_append_data. Sin embargo, el c\u00f3digo que realiz\u00f3 el c\u00e1lculo era incorrecto: ulen = len + skb_queue_empty(\u0026amp;sk-\u0026gt;sk_write_queue)? transhdrlen : 0; ...debido a la precedencia del operador C, esto termina configurando ulen en transhdrlen para mensajes con una longitud distinta de cero, lo que resulta en paquetes corruptos en el cable. Agregue par\u00e9ntesis para corregir el c\u00e1lculo de acuerdo con la intenci\u00f3n original.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.