Riskcovery

CVE-2024-46677

gtp: fix a potential NULL pointer dereference

State
Published
Severity
Not scored
Published
Sep 13, 2024
Updated
May 11, 2026
Reserved
Sep 11, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

gtp: fix a potential NULL pointer dereference

When sockfd_lookup() fails, gtp_encap_enable_socket() returns a NULL pointer, but its callers only check for error pointers thus miss the NULL pointer case.

Fix it by returning an error pointer with the error code carried from sockfd_lookup().

(I found this bug during code inspection.)

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9 to before 620fe9809752fae91b4190e897b81ed9976dfb39Affected
  • 1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9 to before bdd99e5f0ad5fa727b16f2101fe880aa2bff2f8eAffected
  • 1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9 to before 8bbb9e4e0e66a39282e582d0440724055404b38cAffected
  • 1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9 to before 4643b91691e969b1b9ad54bf552d7a990cfa3b87Affected
  • 1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9 to before e8b9930b0eb045d19e883c65ff9676fc89320c70Affected
  • 1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9 to before 28c67f0f84f889fe9f4cbda8354132b20dc9212dAffected
  • 1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9 to before 612edd35f2a3910ab1f61c1f2338889d4ba99fa2Affected
  • 1e3a3abd8b28cfda9d0d0167e50e0fe11bc372a9 to before defd8b3c37b0f9cb3e0f60f47d3d78d459d57fdaAffected
LinuxLinux
  • 4.12Affected
  • before 4.12Not affected
  • 4.19.321 through 4.19.*Not affected
  • 5.4.283 through 5.4.*Not affected
  • 5.10.225 through 5.10.*Not affected
  • 5.15.166 through 5.15.*Not affected
  • 6.1.108 through 6.1.*Not affected
  • 6.6.49 through 6.6.*Not affected
  • 6.10.8 through 6.10.*Not affected
  • 6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.