CVE-2024-41091

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41091
In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tun_xdp_one-->eth_type_trans() may access the Ethernet header although it can be less than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tun_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted for IFF_TAP. This is to drop any frame shorter than the Ethernet header size just like how tun_get_user() does. CVE: CVE-2024-41091

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3 Patch
https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9 Patch
https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 Patch
https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319 Patch
https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5 Patch
https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb Patch
https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 Patch
https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a Patch
https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3 Patch
https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9 Patch
https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 Patch
https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319 Patch
https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5 Patch
https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb Patch
https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 Patch
https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

25 Sep 2025, 20:06

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3 - () https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3 - Patch
References () https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9 - () https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9 - Patch
References () https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 - () https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 - Patch
References () https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319 - () https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319 - Patch
References () https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5 - () https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5 - Patch
References () https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb - () https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb - Patch
References () https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 - () https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 - Patch
References () https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a - () https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
CWE CWE-125
First Time Linux
Linux linux Kernel

21 Nov 2024, 09:32

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3 - () https://git.kernel.org/stable/c/049584807f1d797fc3078b68035450a9769eb5c3 -
References () https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9 - () https://git.kernel.org/stable/c/32b0aaba5dbc85816898167d9b5d45a22eae82e9 -
References () https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 - () https://git.kernel.org/stable/c/589382f50b4a5d90d16d8bc9dcbc0e927a3e39b2 -
References () https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319 - () https://git.kernel.org/stable/c/6100e0237204890269e3f934acfc50d35fd6f319 -
References () https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5 - () https://git.kernel.org/stable/c/8418f55302fa1d2eeb73e16e345167e545c598a5 -
References () https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb - () https://git.kernel.org/stable/c/a9d1c27e2ee3b0ea5d40c105d6e728fc114470bb -
References () https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 - () https://git.kernel.org/stable/c/ad6b3f622ccfb4bfedfa53b6ebd91c3d1d04f146 -
References () https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a - () https://git.kernel.org/stable/c/d5ad89b7d01ed4e66fd04734fc63d6e78536692a -

29 Jul 2024, 14:12

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: tun: agrega verificación faltante para marcos cortos La confirmación citada no pudo verificar la validez de la longitud del marco en la ruta tun_xdp_one(), lo que podría provocar que un skb dañado se envíe hacia abajo. Incluso antes de que se transmita el skb, tun_xdp_one-->eth_type_trans() puede acceder al encabezado de Ethernet aunque puede ser menor que ETH_HLEN. Una vez transmitido, esto podría provocar un acceso fuera de los límites más allá de la longitud real o confundir la capa subyacente con una longitud de encabezado incorrecta o inconsistente en los metadatos de skb. En la ruta alternativa, tun_get_user() ya prohíbe la transmisión de tramas cortas que tengan una longitud menor que el tamaño del encabezado Ethernet para IFF_TAP. Esto es para eliminar cualquier trama más corta que el tamaño del encabezado de Ethernet tal como lo hace tun_get_user(). CVE: CVE-2024-41091

29 Jul 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-29 07:15

Updated : 2025-09-25 20:06

NVD link : CVE-2024-41091

Mitre link : CVE-2024-41091

CVE.ORG link : CVE-2024-41091

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read