tipc: fix UAF in error path

CVE-2024-36886

Summary

The vulnerability identified as CVE-2024-36886 affects the Linux kernel and allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this vulnerability, and it specifically affects systems with the TIPC bearer enabled. The issue stems from the lack of validating the existence of an object prior to performing operations on the object, and an attacker can leverage this vulnerability to execute code in the context of the kernel. Linux has issued an update to correct this vulnerability. No known exploitation or impact by ransomware groups is mentioned in the articles.

News Articles

Rewterz

CVE-2024-36886

CVE-2024-36886 – Linux Kernel Zero-Day Vulnerability - Rewterz

Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by a use-after-free when processing fragmented TIPC messages.

6 months ago

SystemTek

CVE-2024-36886

Linux Kernel TIPC Message Reassembly Use-After-Free Remote Code Execution Vulnerability [CVE-2024-36886]

CVE number = CVE-2024-36886 This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability, but...

6 months ago

References