tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2024-26663
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2024-04-02 07:15:43 UTC
Updated2026-08-04 11:16:54 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0xdffffc0000000010: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000080-0x0000000000000087] ... RIP: 0010:tipc_udp_is_known_peer+0x9c/0x250 net/tipc/udp_media.c:291 ... Call Trace: <TASK> tipc_udp_nl_bearer_add+0x212/0x2f0 net/tipc/udp_media.c:646 tipc_nl_bearer_add+0x21e/0x360 net/tipc/bearer.c:1089 genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972 genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline] genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2544 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline] netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1367 netlink_sendmsg+0x8b7/0xd70 net/netlink/af_netlink.c:1909 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0xd5/0x180 net/socket.c:745 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2584 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2638 __sys_sendmsg+0x117/0x1e0 net/socket.c:2667 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b The cause of this issue is that when tipc_nl_bearer_add() is called with the TIPC_NLA_BEARER_UDP_OPTS attribute, tipc_udp_nl_bearer_add() is called even if the bearer is not UDP. tipc_udp_is_known_peer() called by tipc_udp_nl_bearer_add() assumes that the media_ptr field of the tipc_bearer has an udp_bearer type object, so the function goes crazy for non-UDP bearers. This patch fixes the issue by checking the bearer type before calling tipc_udp_nl_bearer_add() in tipc_nl_bearer_add().

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-476

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary5.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected ef20cd4dd1633987bcf46ac34ace2c8af212361f 24ec8f0da93b8a9fba11600be8a90f0d73fb46f1 git Not specified
CNA Linux Linux affected ef20cd4dd1633987bcf46ac34ace2c8af212361f 6f70f0b412458c622a12d4292782c8e92e210c2f git Not specified
CNA Linux Linux affected ef20cd4dd1633987bcf46ac34ace2c8af212361f 19d7314f2fb9515bdaac9829d4d8eb34edd1fe95 git Not specified
CNA Linux Linux affected ef20cd4dd1633987bcf46ac34ace2c8af212361f c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12 git Not specified
CNA Linux Linux affected ef20cd4dd1633987bcf46ac34ace2c8af212361f 3d3a5b31b43515b5752ff282702ca546ec3e48b6 git Not specified
CNA Linux Linux affected ef20cd4dd1633987bcf46ac34ace2c8af212361f 888e3524be87f3df9fa3c083484e4b62b3e3bb59 git Not specified
CNA Linux Linux affected ef20cd4dd1633987bcf46ac34ace2c8af212361f 0cd331dfd6023640c9669d0592bc0fd491205f87 git Not specified
CNA Linux Linux affected ef20cd4dd1633987bcf46ac34ace2c8af212361f 3871aa01e1a779d866fa9dfdd5a836f342f4eb87 git Not specified
CNA Linux Linux affected 4.9 Not specified
CNA Linux Linux unaffected 4.9 semver Not specified
CNA Linux Linux unaffected 4.19.307 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.269 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.210 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.149 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.78 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.17 6.6.* semver Not specified
CNA Linux Linux unaffected 6.7.5 6.7.* semver Not specified
CNA Linux Linux unaffected 6.8 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
lists.debian.org/debian-lts-announce/2024/06/msg00017.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List
git.kernel.org/stable/c/24ec8f0da93b8a9fba11600be8a90f0d73fb46f1 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/3871aa01e1a779d866fa9dfdd5a836f342f4eb87 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/888e3524be87f3df9fa3c083484e4b62b3e3bb59 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/6f70f0b412458c622a12d4292782c8e92e210c2f af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/19d7314f2fb9515bdaac9829d4d8eb34edd1fe95 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/3d3a5b31b43515b5752ff282702ca546ec3e48b6 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/0cd331dfd6023640c9669d0592bc0fd491205f87 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
git.kernel.org/stable/c/c1701ea85ef0ec7be6a1b36c7da69f572ed2fd12 af854a3a-2127-422b-91ae-364da2661108 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2024/06/msg00020.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org Mailing List
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

Legacy QID Mappings

  • 6000567 Debian Security Update for linux (DSA 5658-1)

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report