<p>There is no fixed version for <code>RHEL:9</code> <code>kernel-zfcpdump-modules-internal</code>.</p>

CVE-2024-26951 Affecting kernel-zfcpdump-modules-internal package, versions *

Threat Intelligence

0.04% (11^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-RHEL9-KERNELZFCPDUMPMODULESINTERNAL-6755002
published 2 May 2024
disclosed 1 May 2024

Report a new vulnerability Found a mistake?

Introduced: 1 May 2024

CVE-2024-26951 Open this link in a new tab

How to fix?

There is no fixed version for RHEL:9 kernel-zfcpdump-modules-internal.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-zfcpdump-modules-internal package and not the kernel-zfcpdump-modules-internal package as distributed by RHEL. See How to fix? for RHEL:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

wireguard: netlink: check for dangling peer via is_dead instead of empty list

If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a temporary list with a head on the stack of wg_peer_remove_all(). If a netlink dump is resumed and the cursored peer is one that has been removed via wg_peer_remove_all(), it will iterate from that peer and then attempt to dump freed peers.

Fix this by instead checking peer->is_dead, which was explictly created for this purpose. Also move up the device_update_lock lockdep assertion, since reading is_dead relies on that.

It can be reproduced by a small script like:

echo &#34;Setting config...&#34;
ip link add dev wg0 type wireguard
wg setconf wg0 /big-config
(
        while true; do
                echo &#34;Showing config...&#34;
                wg showconf wg0 &gt; /dev/null
        done
) &amp;
sleep 4
wg setconf wg0 &lt;(printf &#34;[Peer]\nPublicKey=$(wg genkey)\n&#34;)

Resulting in:

BUG: KASAN: slab-use-after-free in __lock_acquire+0x182a/0x1b20
Read of size 8 at addr ffff88811956ec70 by task wg/59
CPU: 2 PID: 59 Comm: wg Not tainted 6.8.0-rc2-debug+ #5
Call Trace:
 &lt;TASK&gt;
 dump_stack_lvl+0x47/0x70
 print_address_description.constprop.0+0x2c/0x380
 print_report+0xab/0x250
 kasan_report+0xba/0xf0
 __lock_acquire+0x182a/0x1b20
 lock_acquire+0x191/0x4b0
 down_read+0x80/0x440
 get_peer+0x140/0xcb0
 wg_get_device_dump+0x471/0x1130

References

CVSS Scores

version 3.1

CVE-2024-26951 Affecting kernel-zfcpdump-modules-internal package, versions *

Severity

Based on Red Hat Enterprise Linux security rating