CVE-2024-41044

ppp: reject claimed-as-LCP but actually malformed packets

State: Published
Severity: Not scored
Published: Jul 29, 2024
Updated: May 11, 2026
Reserved: Jul 12, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ppp: reject claimed-as-LCP but actually malformed packets

Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP packet has an actual body beyond PPP_LCP header bytes, and reject claimed-as-LCP but actually malformed data otherwise.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 97d1efd8be26615ff680cdde86937d5943138f37Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6e8f1c21174f9482033bbb59f13ce1a8cbe843c3Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3ba12c2afd933fc1bf800f6d3f6c7ec8f602ce56Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ebc5c630457783d17d0c438b0ad70b232a64a82fAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3134bdf7356ed952dcecb480861d2afcc1e40492Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 099502ca410922b56353ccef2749bc0de669da78Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d683e7f3fc48f59576af34631b4fb07fd931343eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f2aeb7306a898e1cbd03963d376f4b6656ca2b55Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.19.318 through 4.19.Not affected 5.4.280 through 5.4.Not affected 5.10.222 through 5.10.Not affected 5.15.163 through 5.15.Not affected 6.1.100 through 6.1.Not affected 6.6.41 through 6.6.Not affected 6.9.10 through 6.9.*Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 97d1efd8be26615ff680cdde86937d5943138f37Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6e8f1c21174f9482033bbb59f13ce1a8cbe843c3Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3ba12c2afd933fc1bf800f6d3f6c7ec8f602ce56Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ebc5c630457783d17d0c438b0ad70b232a64a82fAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 3134bdf7356ed952dcecb480861d2afcc1e40492Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 099502ca410922b56353ccef2749bc0de669da78Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d683e7f3fc48f59576af34631b4fb07fd931343eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f2aeb7306a898e1cbd03963d376f4b6656ca2b55Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.19.318 through 4.19.*Not affected
5.4.280 through 5.4.*Not affected
5.10.222 through 5.10.*Not affected
5.15.163 through 5.15.*Not affected
6.1.100 through 6.1.*Not affected
6.6.41 through 6.6.*Not affected
6.9.10 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.