CVSS 7.8 · High EPSS 0,17%
Kerentanan Use After Free pada linux kernel, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 3.9 hingga sebelum 5.4.297 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.241 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.190 |
| linux | linux kernel | Versi 5.16 hingga sebelum 6.1.148 |
| linux | linux kernel | Versi 6.2 hingga sebelum 6.6.102 |
| linux | linux kernel | Versi 6.7 hingga sebelum 6.12.42 |
| linux | linux kernel | Versi 6.13 hingga sebelum 6.15.10 |
| linux | linux kernel | Versi 6.16 hingga sebelum 6.16.1 |
| linux | linux kernel | Versi 6.17 rc1 |
| debian | debian linux | Versi 11.0 |