CVE-2024-36954

Summary

In the Linux kernel, the following vulnerability has been resolved:

tipc: fix a possible memleak in tipc_buf_append

__skb_linearize() doesn't free the skb when it fails, so move '*buf = NULL' after __skb_linearize(), so that the skb can be freed on the err path.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux4b1761898861117c97066aea6c58f68a7787f0bf < 01cd1b7b685751ee422d00d050292a3d277652d6affected
LinuxLinux64d17ec9f1ded042c4b188d15734f33486ed9966 < 2f87fd9476cf9725d774e6dcb7d17859c6a6d1aeaffected
LinuxLinux6da24cfc83ba4f97ea44fc7ae9999a006101755c < adbce6d20da6254c86425a8d4359b221b5ccbccdaffected
LinuxLinuxb7df21cf1b79ab7026f545e7bf837bd5750ac026 < 42c8471b0566c7539e7dd584b4d0ebd3cec8cb2caffected
LinuxLinuxb7df21cf1b79ab7026f545e7bf837bd5750ac026 < d03a82f4f8144befdc10518e732e2a60b34c870eaffected
LinuxLinuxb7df21cf1b79ab7026f545e7bf837bd5750ac026 < 614c5a5ae45a921595952117b2e2bd4d4bf9b574affected
LinuxLinuxb7df21cf1b79ab7026f545e7bf837bd5750ac026 < 3210d34fda4caff212cb53729e6bd46de604d565affected
LinuxLinuxb7df21cf1b79ab7026f545e7bf837bd5750ac026 < 97bf6f81b29a8efaf5d0983251a7450e5794370daffected
LinuxLinuxb2c8d28c34b3070407cb1741f9ba3f15d0284b8baffected
LinuxLinux5489f30bb78ff0dafb4229a69632afc2ba20765caffected
LinuxLinux436d650d374329a591c30339a91fa5078052ed1eaffected
LinuxLinuxace300eecbccaa698e2b472843c74a5f33f7dce8affected
LinuxLinux4.19.193 < 4.19.314affected
LinuxLinux5.4.124 < 5.4.276affected
LinuxLinux5.10.42 < 5.10.217affected
LinuxLinux4.4.271 < 4.5affected
LinuxLinux4.9.271 < 4.10affected
LinuxLinux4.14.235 < 4.15affected
LinuxLinux5.12.9 < 5.13affected
LinuxLinux5.13affected
LinuxLinux0 < 5.13unaffected
LinuxLinux4.19.314 <= 4.19.*unaffected
LinuxLinux5.4.276 <= 5.4.*unaffected
LinuxLinux5.10.217 <= 5.10.*unaffected
LinuxLinux5.15.159 <= 5.15.*unaffected
LinuxLinux6.1.91 <= 6.1.*unaffected
LinuxLinux6.6.31 <= 6.6.*unaffected
LinuxLinux6.8.10 <= 6.8.*unaffected
LinuxLinux6.9 <= *unaffected

Weaknesses

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References