CVE-2024-36883

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-36883
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-36883.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-36883
Downstream
Related
Published
2024-05-30T15:28:53.302Z
Modified
2026-03-13T07:55:37.905962Z
Summary
net: fix out-of-bounds access in ops_init
Details

In the Linux kernel, the following vulnerability has been resolved:

net: fix out-of-bounds access in ops_init

netallocgeneric is called by netalloc, which is called without any locking. It reads maxgenptrs, which is changed under pernetops_rwsem. It is read twice, first to allocate an array, then to set s.len, which is later used to limit the bounds of the array access.

It is possible that the array is allocated and another thread is registering a new pernet ops, increments maxgenptrs, which is then used to set s.len with a larger than allocated length for the variable array.

Fix it by reading maxgenptrs only once in netallocgeneric. If maxgenptrs is later incremented, it will be caught in netassigngeneric.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36883.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
073862ba5d249c20bd5c49fc6d904ff0e1f6a672
Fixed
3cdc34d76c4f777579e28ad373979d36c030cfd3
Fixed
7b0e64583eab8c1d896b47e5dd0bf2e7d86ec41f
Fixed
0c3248bc708a7797be573214065cf908ff1f54c7
Fixed
9518b79bfd2fbf99fa9b7e8e36bcb1825e7ba030
Fixed
2d60ff5874aefd006717ca5e22ac1e25eac29c42
Fixed
b6dbfd5bcc267a95a0bf1bf96af46243f96ec6cd
Fixed
f4f94587e1bf87cb40ec33955a9d90148dd026ab
Fixed
a26ff37e624d12e28077e5b24d2b264f62764ad6
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
561331eae0a03d0c4cf60f3cf485aa3e8aa5ab48
Last affected
a2c82f7bee1ffa9eafa1fb0bd886a7eea8c9e497

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-36883.json"