Bug 2308652 (CVE-2024-44944)
| Summary: | CVE-2024-44944 kernel: netfilter: ctnetlink: use helper function to calculate expect ID | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dfreiber, drow, jburrell, rhel-process-autobot, vkumar, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in the Linux kernel's netfilter connection tracking (ctnetlink) component. A missing helper function call in the expectation deletion path allows a local attacker to leak the least significant byte (LSB) of an expectation object's memory address to userspace. This information disclosure could potentially aid in bypassing Address Space Layout Randomization (ASLR) and facilitate further attacks.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2308674 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2024-08-30 08:20:31 UTC
|