CVE-2024-26752

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26752
In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuff. To manage this, we check whether the skbuff contains data using skb_queue_empty when deciding how much data to append using ip6_append_data. However, the code which performed the calculation was incorrect: ulen = len + skb_queue_empty(&sk->sk_write_queue) ? transhdrlen : 0; ...due to C operator precedence, this ends up setting ulen to transhdrlen for messages with a non-zero length, which results in corrupted packets on the wire. Add parentheses to correct the calculation in line with the original intent.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d Patch
https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500 Patch
https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 Patch
https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae Patch
https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56 Patch
https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6 Patch
https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5 Patch
https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243 Patch
https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d Patch
https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500 Patch
https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 Patch
https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae Patch
https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56 Patch
https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6 Patch
https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5 Patch
https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243 Patch
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Mailing List
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14.327:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.5.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

17 Mar 2025, 16:57

Type Values Removed Values Added
CWE CWE-131
First Time Debian
Linux linux Kernel
Linux
Debian debian Linux
References () https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d - () https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d - Patch
References () https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500 - () https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500 - Patch
References () https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 - () https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 - Patch
References () https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae - () https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae - Patch
References () https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56 - () https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56 - Patch
References () https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6 - () https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6 - Patch
References () https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5 - () https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5 - Patch
References () https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243 - () https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html - Mailing List
CPE cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.14.327:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.5.7:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Nov 2024, 09:02

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -
References () https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d - () https://git.kernel.org/stable/c/0da15a70395182ee8cb75716baf00dddc0bea38d -
References () https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500 - () https://git.kernel.org/stable/c/13cd1daeea848614e585b2c6ecc11ca9c8ab2500 -
References () https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 - () https://git.kernel.org/stable/c/359e54a93ab43d32ee1bff3c2f9f10cb9f6b6e79 -
References () https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae - () https://git.kernel.org/stable/c/4c3ce64bc9d36ca9164dd6c77ff144c121011aae -
References () https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56 - () https://git.kernel.org/stable/c/804bd8650a3a2bf3432375f8c97d5049d845ce56 -
References () https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6 - () https://git.kernel.org/stable/c/83340c66b498e49353530e41542500fc8a4782d6 -
References () https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5 - () https://git.kernel.org/stable/c/c1d3a84a67db910ce28a871273c992c3d7f9efb5 -
References () https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243 - () https://git.kernel.org/stable/c/dcb4d14268595065c85dc5528056713928e17243 -

05 Nov 2024, 10:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

25 Jun 2024, 22:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html -
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: l2tp: pasa la longitud correcta del mensaje a ip6_append_data l2tp_ip6_sendmsg necesita evitar tener en cuenta el encabezado de transporte dos veces al unir más datos en un skbuff ya parcialmente ocupado. Para gestionar esto, verificamos si skbuff contiene datos usando skb_queue_empty al decidir cuántos datos agregar usando ip6_append_data. Sin embargo, el código que realizó el cálculo era incorrecto: ulen = len + skb_queue_empty(&sk->sk_write_queue)? transhdrlen : 0; ...debido a la precedencia del operador C, esto termina configurando ulen en transhdrlen para mensajes con una longitud distinta de cero, lo que resulta en paquetes corruptos en el cable. Agregue paréntesis para corregir el cálculo de acuerdo con la intención original.

03 Apr 2024, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-03 17:15

Updated : 2025-03-17 16:57

NVD link : CVE-2024-26752

Mitre link : CVE-2024-26752

CVE.ORG link : CVE-2024-26752

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-131

Incorrect Calculation of Buffer Size