CVE-2024-26707

CVE Details

Release Date:

2024-04-03

Description

In the Linux kernel, the following vulnerability has been resolved:\nnet: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()\nSyzkaller reported [1] hitting a warning after failing to allocate\nresources for skb in hsr_init_skb(). Since a WARN_ONCE() call will\nnot help much in this case, it might be prudent to switch to\nnetdev_warn_once(). At the very least it will suppress syzkaller\nreports such as [1].\nJust in case, use netdev_warn_once() in send_prp_supervision_frame()\nfor similar reasons.\n[1]\nHSR: Could not send supervision frame\nWARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\nRIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294\n...\nCall Trace:\n\nhsr_announce+0x114/0x370 net/hsr/hsr_device.c:382\ncall_timer_fn+0x193/0x590 kernel/time/timer.c:1700\nexpire_timers kernel/time/timer.c:1751 [inline]\n__run_timers+0x764/0xb20 kernel/time/timer.c:2022\nrun_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035\n__do_softirq+0x21a/0x8de kernel/softirq.c:553\ninvoke_softirq kernel/softirq.c:427 [inline]\n__irq_exit_rcu kernel/softirq.c:632 [inline]\nirq_exit_rcu+0xb7/0x120 kernel/softirq.c:644\nsysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076\n\n\nasm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649\n...\nThis issue is also found in older kernels (at least up to 5.10).

See more information about CVE-2024-26707 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	0.0
Vector String:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	Low
User Interaction:	None
Scope:	Unchanged
Confidentiality:	None
Integrity:	None
Availability:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14