CVE-2024-36946

Katalog CVE

CVSS 5.5 · Medium EPSS 0,27%

Kerentanan Missing Release of Memory after Effective Lifetime pada linux kernel, debian linux. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtm_phonet_notify() skb allocation fill_route() stores three components in the skb: - struct rtmsg - RTA_DST (u8) - RTA_OIF (u32) Therefore, rtm_phonet_notify() should use NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(1) + nla_total_size(4)

Rincian

Terbit di NVD

30 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/4ff334cade9dae50e4be387f71e94fae634aa9b4 patch
• https://git.kernel.org/stable/c/728a83160f98ee6b60df0d890141b9b7240182fe patch
• https://git.kernel.org/stable/c/9a77226440008cf04ba68faf641a2d50f4998137 patch
• https://git.kernel.org/stable/c/d8cac8568618dcb8a51af3db1103e8d4cc4aeea7 patch
• https://git.kernel.org/stable/c/dc6beac059f0331de97155a89d84058d4a9e49c7 patch
• https://git.kernel.org/stable/c/ec1f71c05caeba0f814df77e0f511d8b4618623a patch
• https://git.kernel.org/stable/c/ee9e39a6cb3ca2a3d35b4ae25547ee3526a44d00 patch
• https://git.kernel.org/stable/c/f085e02f0a32f6dfcfabc6535c9c4a1707cef86b patch
• https://lists.debian.org/debian-lts-announce/2024/06/msg00019.html advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20241004-0002/ advisory pihak ketiga