CVE-2024-49571

net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg

State: Published
Severity: 9.1 Critical
Published: Jan 11, 2025
Updated: Aug 5, 2026
Reserved: Jan 11, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg

When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg are from the remote client and can not be fully trusted. Especially the field iparea_offset, once exceed the max value, there has the chance to access wrong address, and crash may happen.

This patch checks iparea_offset and ipv6_prefixes_cnt before using them.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e7b7a64a8493d47433fd003efbe6543e3f676294 to before 846bada23bfcdeb83621b045ed85dc06c7833ff0Affected e7b7a64a8493d47433fd003efbe6543e3f676294 to before f10635268a0a49ee902a3b63b5dbb76f4fed498eAffected e7b7a64a8493d47433fd003efbe6543e3f676294 to before 62056d1592e63d85e82357ee2ae6a6a294f440b0Affected e7b7a64a8493d47433fd003efbe6543e3f676294 to before 91a7c27c1444ed4677b83fd5308d2cf03f5f0851Affected e7b7a64a8493d47433fd003efbe6543e3f676294 to before 47ce46349672a7e0c361bfe39ed0b22e824ef4fbAffected e7b7a64a8493d47433fd003efbe6543e3f676294 to before a29e220d3c8edbf0e1beb0f028878a4a85966556Affected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.233 through 5.10.Not affected 5.15.176 through 5.15.Not affected 6.1.122 through 6.1.Not affected 6.6.68 through 6.6.Not affected 6.12.7 through 6.12.*Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

e7b7a64a8493d47433fd003efbe6543e3f676294 to before 846bada23bfcdeb83621b045ed85dc06c7833ff0Affected
e7b7a64a8493d47433fd003efbe6543e3f676294 to before f10635268a0a49ee902a3b63b5dbb76f4fed498eAffected
e7b7a64a8493d47433fd003efbe6543e3f676294 to before 62056d1592e63d85e82357ee2ae6a6a294f440b0Affected
e7b7a64a8493d47433fd003efbe6543e3f676294 to before 91a7c27c1444ed4677b83fd5308d2cf03f5f0851Affected
e7b7a64a8493d47433fd003efbe6543e3f676294 to before 47ce46349672a7e0c361bfe39ed0b22e824ef4fbAffected
e7b7a64a8493d47433fd003efbe6543e3f676294 to before a29e220d3c8edbf0e1beb0f028878a4a85966556Affected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.233 through 5.10.*Not affected
5.15.176 through 5.15.*Not affected
6.1.122 through 6.1.*Not affected
6.6.68 through 6.6.*Not affected
6.12.7 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.