In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage. [1] BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 __pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendms ---truncated---

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2394 advisory.

  - kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)

  - kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)

  - kernel: vmwgfx: NULL pointer dereference in vmw_cmd_dx_define_query (CVE-2022-38096)

  - kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)

  - kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race (CVE-2023-3567)

  - kernel: cxgb4: use-after-free in ch_flower_stats_cb() (CVE-2023-4133)

  - kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)

  - kernel: NVMe: info leak due to out-of-bounds read in nvmet_ctrl_find_get (CVE-2023-6121)

  - kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)

  - kernel: GC's deletion of an SKB races with unix_stream_read_generic()  leading to UAF (CVE-2023-6531)

  - kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)

  - kernel: null pointer dereference vulnerability in nft_dynset_init() (CVE-2023-6622)

  - kernel: Null Pointer Dereference vulnerability in ida_free in lib/idr.c (CVE-2023-6915)

  - kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size     (CVE-2023-6931)

  - kernel: use-after-free in IPv4 IGMP (CVE-2023-6932)

  - kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)

  - kernel: irdma: Improper access control (CVE-2023-25775)

  - Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)

  - kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)

  - kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)

  - kernel: usb: out-of-bounds read in read_descriptors (CVE-2023-37453)

  - kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one() (CVE-2023-39189)

  - kernel: netfilter: xtables sctp out-of-bounds read in match_flags() (CVE-2023-39193)

  - kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match() (CVE-2023-39194)

  - kernel: QXL: race condition leading to use-after-free in qxl_mode_dumb_create() (CVE-2023-39198)

  - kernel: ipv4: NULL pointer dereference in ipv4_send_dest_unreach() (CVE-2023-42754)

  - kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)

  - kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)

  - kernel: NULL pointer dereference vulnerability in io_uring_show_fdinfo (CVE-2023-46862)

  - kernel: use-after-free during a race condition between a nonblocking atomic commit and a driver unload in     drivers/gpu/drm/drm_atomic.c (CVE-2023-51043)

  - kernel: bluetooth: bt_sock_ioctl race condition leads to use-after-free in bt_sock_recvmsg     (CVE-2023-51779)

  - kernel: use-after-free in net/atm/ioctl.c (CVE-2023-51780)

  - kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)

  - kernel: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (CVE-2023-52448)

  - kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)

  - kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)

  - kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)

  - kernel: HID: sony: Fix a potential memory leak in sony_probe() (CVE-2023-52529)

  - kernel: team: NULL pointer dereference when team device type is changed (CVE-2023-52574)

  - kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)

  - kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)

  - kernel: netfilter: nf_tables: memory leak when more than 255 elements expired (CVE-2023-52581)

  - kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)

  - kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)

  - kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in     function receive_encrypted_standard of client (CVE-2024-0565)

  - kernel: hugetlbfs: Null pointer dereference in hugetlbfs_fill_super function (CVE-2024-0841)

  - kernel: nf_tables: use-after-free vulnerability in the nft_setelem_catchall_deactivate() function     (CVE-2024-1085)

  - kernel: nf_tables: use-after-free vulnerability in the nft_verdict_init() function (CVE-2024-1086)

  - kernel: tls: use-after-free with partial reads and async decrypt (CVE-2024-26582)

  - kernel: tls: race between async notify and socket close (CVE-2024-26583)

  - kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)

  - kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)

  - kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)

  - kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)

  - kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)

  - kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)

  - kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195662	RHEL 6 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195652	RHEL 7 : kernel (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
195118	Ubuntu 22.04 LTS : Linux kernel (OEM) vulnerabilities (USN-6765-1)	Nessus	Ubuntu Local Security Checks	high
195036	Oracle Linux 9 : kernel (ELSA-2024-2394)	Nessus	Oracle Linux Local Security Checks	critical
194794	RHEL 9 : kernel (RHSA-2024:2394)	Nessus	Red Hat Local Security Checks	critical
193407	Ubuntu 20.04 LTS : Linux kernel (Xilinx ZynqMP) vulnerabilities (USN-6726-3)	Nessus	Ubuntu Local Security Checks	high
193376	Ubuntu 20.04 LTS : Linux kernel (IoT) vulnerabilities (USN-6726-2)	Nessus	Ubuntu Local Security Checks	high
193375	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel (AWS) vulnerabilities (USN-6725-2)	Nessus	Ubuntu Local Security Checks	critical
193084	Ubuntu 20.04 LTS / 22.04 LTS : Linux kernel vulnerabilities (USN-6725-1)	Nessus	Ubuntu Local Security Checks	critical
193081	Ubuntu 18.04 LTS / 20.04 LTS : Linux kernel vulnerabilities (USN-6726-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2024-26633

medium

Tenable Plugins

critical

critical

high

critical

critical

high

high

critical

critical

high