CVE-2024-36903: linux-libc-dev - Fix potential uninit-value access in __ip6_make_skb()
Summary
CVE-2024-36903: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in ip6_make_skb() As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in ip_make_skb()") for I... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package that provides the Linux kernel headers for development. It includes the necessary files and definitions for compiling and building kernel modules. This package is essential for developers who need to build and test kernel modules on Debian-based systems. However, a vulnerability has been discovered in the package that could lead to potential uninit-value access in the __ip6_make_skb() function of the IPv6 implementation in the Linux kernel.
Vulnerability Detail
The vulnerability in linux-libc-dev arises from a race condition that causes uninit-value access. Specifically, the issue lies in the __ip6_make_skb() function of the IPv6 implementation. The vulnerability can be triggered when the HDRINCL flag is tested on the socket, leading to potential uninit-value access. An attacker could potentially exploit this vulnerability to gain unauthorized access or execute arbitrary code. The impact of this vulnerability is considered medium, with a CVSS score of 5.5.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have the latest security updates installed and by following best practices for system security.
Conclusion
The linux-libc-dev package is vulnerable to a race condition that can lead to potential uninit-value access in the __ip6_make_skb() function of the IPv6 implementation in the Linux kernel. To mitigate this vulnerability, it is crucial to update the package to version 6.1.90-1 or later. Regularly applying security updates and following best practices for system security is also recommended. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package that provides the Linux kernel headers for development. It includes the necessary files and definitions for compiling and building kernel modules.
The vulnerability could potentially allow an attacker to gain unauthorized access or execute arbitrary code.
The CVSS score of this vulnerability is 5.5, indicating a medium severity.
To fix this vulnerability, it is recommended to update the linux-libc-dev package to version 6.1.90-1 or later.
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring they have the latest security updates installed and by following best practices for system security.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
