cve-2024-35982
Vulnerability from cvelistv5
Published
2024-05-20 09:42
Modified
2024-11-05 09:26
Severity ?
5.1 (Medium) - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
batman-adv: Avoid infinite loop trying to resize local TT
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/04720ea2e6c64459a90ca28570ea78335eccd924Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3fe79b2c83461edbbf86ed8a6f3924820ff89259Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4ca2a5fb54ea2cc43edea614207fcede562d91c2Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/70a8be9dc2fb65d67f8c1e0c88c587e08e2e575dPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/87b6af1a7683e021710c08fc0551fc078346032fPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b1f532a3b1e6d2e5559c7ace49322922637a28aaPatch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b3ddf6904073990492454b1dd1c10a24be8c74c6Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ca54e2671548616ad34885f90d4f26f7adb088f0Patch
Impacted products
Vendor Product Version
Linux Linux Version: 3.13
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:3.13:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "3.13"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-35982",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-20T13:42:24.669316Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:33:51.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:48.996Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/04720ea2e6c64459a90ca28570ea78335eccd924"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b3ddf6904073990492454b1dd1c10a24be8c74c6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/70a8be9dc2fb65d67f8c1e0c88c587e08e2e575d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/87b6af1a7683e021710c08fc0551fc078346032f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3fe79b2c83461edbbf86ed8a6f3924820ff89259"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4ca2a5fb54ea2cc43edea614207fcede562d91c2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ca54e2671548616ad34885f90d4f26f7adb088f0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/b1f532a3b1e6d2e5559c7ace49322922637a28aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/translation-table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "04720ea2e6c6",
              "status": "affected",
              "version": "a19d3d85e1b8",
              "versionType": "git"
            },
            {
              "lessThan": "b3ddf6904073",
              "status": "affected",
              "version": "a19d3d85e1b8",
              "versionType": "git"
            },
            {
              "lessThan": "70a8be9dc2fb",
              "status": "affected",
              "version": "a19d3d85e1b8",
              "versionType": "git"
            },
            {
              "lessThan": "87b6af1a7683",
              "status": "affected",
              "version": "a19d3d85e1b8",
              "versionType": "git"
            },
            {
              "lessThan": "3fe79b2c8346",
              "status": "affected",
              "version": "a19d3d85e1b8",
              "versionType": "git"
            },
            {
              "lessThan": "4ca2a5fb54ea",
              "status": "affected",
              "version": "a19d3d85e1b8",
              "versionType": "git"
            },
            {
              "lessThan": "ca54e2671548",
              "status": "affected",
              "version": "a19d3d85e1b8",
              "versionType": "git"
            },
            {
              "lessThan": "b1f532a3b1e6",
              "status": "affected",
              "version": "a19d3d85e1b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/batman-adv/translation-table.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.13"
            },
            {
              "lessThan": "3.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.313",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.275",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.156",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbatman-adv: Avoid infinite loop trying to resize local TT\n\nIf the MTU of one of an attached interface becomes too small to transmit\nthe local translation table then it must be resized to fit inside all\nfragments (when enabled) or a single packet.\n\nBut if the MTU becomes too low to transmit even the header + the VLAN\nspecific part then the resizing of the local TT will never succeed. This\ncan for example happen when the usable space is 110 bytes and 11 VLANs are\non top of batman-adv. In this case, at least 116 byte would be needed.\nThere will just be an endless spam of\n\n   batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)\n\nin the log but the function will never finish. Problem here is that the\ntimeout will be halved all the time and will then stagnate at 0 and\ntherefore never be able to reduce the table even more.\n\nThere are other scenarios possible with a similar result. The number of\nBATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too\nhigh to fit inside a packet. Such a scenario can therefore happen also with\nonly a single VLAN + 7 non-purgable addresses - requiring at least 120\nbytes.\n\nWhile this should be handled proactively when:\n\n* interface with too low MTU is added\n* VLAN is added\n* non-purgeable local mac is added\n* MTU of an attached interface is reduced\n* fragmentation setting gets disabled (which most likely requires dropping\n  attached interfaces)\n\nnot all of these scenarios can be prevented because batman-adv is only\nconsuming events without the the possibility to prevent these actions\n(non-purgable MAC address added, MTU of an attached interface is reduced).\nIt is therefore necessary to also make sure that the code is able to handle\nalso the situations when there were already incompatible system\nconfiguration are present."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-05T09:26:11.936Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/04720ea2e6c64459a90ca28570ea78335eccd924"
        },
        {
          "url": "https://git.kernel.org/stable/c/b3ddf6904073990492454b1dd1c10a24be8c74c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/70a8be9dc2fb65d67f8c1e0c88c587e08e2e575d"
        },
        {
          "url": "https://git.kernel.org/stable/c/87b6af1a7683e021710c08fc0551fc078346032f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fe79b2c83461edbbf86ed8a6f3924820ff89259"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ca2a5fb54ea2cc43edea614207fcede562d91c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca54e2671548616ad34885f90d4f26f7adb088f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b1f532a3b1e6d2e5559c7ace49322922637a28aa"
        }
      ],
      "title": "batman-adv: Avoid infinite loop trying to resize local TT",
      "x_generator": {
        "engine": "bippy-9e1c9544281a"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35982",
    "datePublished": "2024-05-20T09:42:06.397Z",
    "dateReserved": "2024-05-17T13:50:33.144Z",
    "dateUpdated": "2024-11-05T09:26:11.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35982\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-20T10:15:12.687\",\"lastModified\":\"2024-11-05T10:17:00.107\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbatman-adv: Avoid infinite loop trying to resize local TT\\n\\nIf the MTU of one of an attached interface becomes too small to transmit\\nthe local translation table then it must be resized to fit inside all\\nfragments (when enabled) or a single packet.\\n\\nBut if the MTU becomes too low to transmit even the header + the VLAN\\nspecific part then the resizing of the local TT will never succeed. This\\ncan for example happen when the usable space is 110 bytes and 11 VLANs are\\non top of batman-adv. In this case, at least 116 byte would be needed.\\nThere will just be an endless spam of\\n\\n   batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)\\n\\nin the log but the function will never finish. Problem here is that the\\ntimeout will be halved all the time and will then stagnate at 0 and\\ntherefore never be able to reduce the table even more.\\n\\nThere are other scenarios possible with a similar result. The number of\\nBATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too\\nhigh to fit inside a packet. Such a scenario can therefore happen also with\\nonly a single VLAN + 7 non-purgable addresses - requiring at least 120\\nbytes.\\n\\nWhile this should be handled proactively when:\\n\\n* interface with too low MTU is added\\n* VLAN is added\\n* non-purgeable local mac is added\\n* MTU of an attached interface is reduced\\n* fragmentation setting gets disabled (which most likely requires dropping\\n  attached interfaces)\\n\\nnot all of these scenarios can be prevented because batman-adv is only\\nconsuming events without the the possibility to prevent these actions\\n(non-purgable MAC address added, MTU of an attached interface is reduced).\\nIt is therefore necessary to also make sure that the code is able to handle\\nalso the situations when there were already incompatible system\\nconfiguration are present.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: batman-adv: Evite el bucle infinito al intentar cambiar el tama\u00f1o del TT local. Si la MTU de una de las interfaces conectadas se vuelve demasiado peque\u00f1a para transmitir la tabla de traducci\u00f3n local, entonces se debe cambiar su tama\u00f1o para que quepa dentro. todos los fragmentos (cuando est\u00e1 habilitado) o un solo paquete. Pero si la MTU es demasiado baja para transmitir incluso el encabezado + la parte espec\u00edfica de la VLAN, entonces el cambio de tama\u00f1o del TT local nunca tendr\u00e1 \u00e9xito. Esto puede suceder, por ejemplo, cuando el espacio utilizable es de 110 bytes y hay 11 VLAN encima de batman-adv. En este caso, se necesitar\u00edan al menos 116 bytes. Simplemente habr\u00e1 un spam interminable de batman_adv: batadv0: Obligado a purgar las entradas tt locales para ajustar el nuevo fragmento m\u00e1ximo MTU (110) en el registro, pero la funci\u00f3n nunca finalizar\u00e1. El problema aqu\u00ed es que el tiempo de espera se reducir\u00e1 a la mitad todo el tiempo y luego se estancar\u00e1 en 0 y, por lo tanto, nunca podr\u00e1 reducir la tabla a\u00fan m\u00e1s. Hay otros escenarios posibles con un resultado similar. El n\u00famero de entradas BATADV_TT_CLIENT_NOPURGE en el TT local puede, por ejemplo, ser demasiado alto para caber dentro de un paquete. Por lo tanto, este escenario puede ocurrir tambi\u00e9n con una sola VLAN + 7 direcciones no purgables, lo que requiere al menos 120 bytes. Si bien esto debe manejarse de manera proactiva cuando: * se agrega una interfaz con una MTU demasiado baja * se agrega una VLAN * se agrega una mac local no purgable * se reduce la MTU de una interfaz conectada * la configuraci\u00f3n de fragmentaci\u00f3n se desactiva (lo que probablemente requiera eliminar las interfaces conectadas) No todos estos escenarios se pueden prevenir porque batman-adv solo consume eventos sin la posibilidad de evitar estas acciones (se agrega una direcci\u00f3n MAC no purgable, se reduce la MTU de una interfaz adjunta). Por lo tanto, tambi\u00e9n es necesario asegurarse de que el c\u00f3digo sea capaz de manejar tambi\u00e9n las situaciones en las que ya hab\u00eda una configuraci\u00f3n del sistema incompatible.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\",\"baseScore\":5.1,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.4,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-835\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.13\",\"versionEndExcluding\":\"4.19.313\",\"matchCriteriaId\":\"22DD99BA-225B-49F6-AD13-22F00AEDE90F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.275\",\"matchCriteriaId\":\"5FF6D8DE-C559-4586-86C8-2C6B4420A2C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.216\",\"matchCriteriaId\":\"A44ABF89-F1BD-4C9A-895D-7596650DCD27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.156\",\"matchCriteriaId\":\"E80AFAB4-A9F3-415C-8D6C-52D1C13F1531\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.87\",\"matchCriteriaId\":\"BDA59296-EDB8-44CD-98E4-C08C051569E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.28\",\"matchCriteriaId\":\"8D6315B0-B3BA-406C-B0DB-51D9A63753F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.7\",\"matchCriteriaId\":\"531BDFB5-EF6A-4707-902E-146368303499\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04720ea2e6c64459a90ca28570ea78335eccd924\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3fe79b2c83461edbbf86ed8a6f3924820ff89259\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4ca2a5fb54ea2cc43edea614207fcede562d91c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/70a8be9dc2fb65d67f8c1e0c88c587e08e2e575d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/87b6af1a7683e021710c08fc0551fc078346032f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b1f532a3b1e6d2e5559c7ace49322922637a28aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b3ddf6904073990492454b1dd1c10a24be8c74c6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ca54e2671548616ad34885f90d4f26f7adb088f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.