The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd.…
High CVSS 7.8
Summary
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Lint boundary warnings (2)
The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://syzkaller.appspot.com/bug?id=96e7d345748d8814901c91cd92084ed04b46701e -
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://syzkaller.appspot.com/bug?id=96e7d345748d8814901c91cd92084ed04b46701e
Sources
- NVD DATABASE
Original Links
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.14 Mailing List
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.7 Mailing List
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1165affd484889d4986cf3b724318935a0b120d8 Mailing List
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ad5d07f4a9cd671233ae20983848874731102c08 Mailing List
- https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-cipso_v4_genopt Exploit
- https://syzkaller.appspot.com/bug?id=96e7d345748d8814901c91cd92084ed04b46701e Exploit
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.14 Mailing List
- https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.11.7 Mailing List
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1165affd484889d4986cf3b724318935a0b120d8 Mailing List
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ad5d07f4a9cd671233ae20983848874731102c08 Mailing List
- https://sites.google.com/view/syzscope/kasan-use-after-free-read-in-cipso_v4_genopt Exploit
- https://syzkaller.appspot.com/bug?id=96e7d345748d8814901c91cd92084ed04b46701e Exploit
Timeline
- nvd_ingest NVD