CVE-2024-27418

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-27418
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-27418.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-27418
Downstream
Related
Published
2024-05-17T11:51:11Z
Modified
2025-10-15T10:23:10.038993Z
Summary
net: mctp: take ownership of skb in mctp_local_output
Details

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: take ownership of skb in mctplocaloutput

Currently, mctplocaloutput only takes ownership of skb on success, and we may leak an skb if mctplocaloutput fails in specific states; the skb ownership isn't transferred until the actual output routing occurs.

Instead, make mctplocaloutput free the skb on all error paths up to the route action, so it always consumes the passed skb.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
833ef3b91de692ef33b800bca6b1569c39dece74
Fixed
a3c8fa54e904b0ddb52a08cc2d8ac239054f61fd
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
833ef3b91de692ef33b800bca6b1569c39dece74
Fixed
cbebc55ceacef1fc0651e80e0103cc184552fc68
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
833ef3b91de692ef33b800bca6b1569c39dece74
Fixed
a639441c880ac479495e5ab37e3c29f21ae5771b
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
833ef3b91de692ef33b800bca6b1569c39dece74
Fixed
3773d65ae5154ed7df404b050fd7387a36ab5ef3

Affected versions

v5.*

v5.14
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8

v6.*

v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.11
v6.1.12
v6.1.13
v6.1.14
v6.1.15
v6.1.16
v6.1.17
v6.1.18
v6.1.19
v6.1.2
v6.1.20
v6.1.21
v6.1.22
v6.1.23
v6.1.24
v6.1.25
v6.1.26
v6.1.27
v6.1.28
v6.1.29
v6.1.3
v6.1.30
v6.1.31
v6.1.32
v6.1.33
v6.1.34
v6.1.35
v6.1.36
v6.1.37
v6.1.38
v6.1.39
v6.1.4
v6.1.40
v6.1.41
v6.1.42
v6.1.43
v6.1.44
v6.1.45
v6.1.46
v6.1.47
v6.1.48
v6.1.49
v6.1.5
v6.1.50
v6.1.51
v6.1.52
v6.1.53
v6.1.54
v6.1.55
v6.1.56
v6.1.57
v6.1.58
v6.1.59
v6.1.6
v6.1.60
v6.1.61
v6.1.62
v6.1.63
v6.1.64
v6.1.65
v6.1.66
v6.1.67
v6.1.68
v6.1.69
v6.1.7
v6.1.70
v6.1.71
v6.1.72
v6.1.73
v6.1.74
v6.1.75
v6.1.76
v6.1.77
v6.1.78
v6.1.79
v6.1.8
v6.1.80
v6.1.9
v6.2
v6.2-rc1
v6.2-rc2
v6.2-rc3
v6.2-rc4
v6.2-rc5
v6.2-rc6
v6.2-rc7
v6.2-rc8
v6.3
v6.3-rc1
v6.3-rc2
v6.3-rc3
v6.3-rc4
v6.3-rc5
v6.3-rc6
v6.3-rc7
v6.4
v6.4-rc1
v6.4-rc2
v6.4-rc3
v6.4-rc4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.7.1
v6.7.2
v6.7.3
v6.7.4
v6.7.5
v6.7.6
v6.7.7
v6.7.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5

Database specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "line_hashes": [
                    "169154541564225413285292491794675047730",
                    "70077343444438639277775535874915579454",
                    "136597573669856433216641724527882506652",
                    "188702749759457363120972570225471975350",
                    "335352559520697964503703470903528144926",
                    "218975542163605580779584854593371779556",
                    "137591691809033937525256792378272001247",
                    "58842588577594266193200876452680762421",
                    "54395473412109098785461435680667127254",
                    "116003468230321547799027379498892699859",
                    "46258284087205771180421514880674817015",
                    "267656662058333552751125942154619144404",
                    "295902405144230405955990980847063049780",
                    "157345914817278339543940684369869078635",
                    "247771655723590564984157167542702336258"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/mctp/route.c"
            },
            "signature_type": "Line",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a639441c880ac479495e5ab37e3c29f21ae5771b",
            "deprecated": false,
            "signature_version": "v1",
            "id": "CVE-2024-27418-02533a33"
        },
        {
            "digest": {
                "length": 2058.0,
                "function_hash": "67329696690158115368203754178793330658"
            },
            "target": {
                "function": "mctp_local_output",
                "file": "net/mctp/route.c"
            },
            "signature_type": "Function",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a639441c880ac479495e5ab37e3c29f21ae5771b",
            "deprecated": false,
            "signature_version": "v1",
            "id": "CVE-2024-27418-165edad3"
        },
        {
            "digest": {
                "line_hashes": [
                    "169154541564225413285292491794675047730",
                    "70077343444438639277775535874915579454",
                    "136597573669856433216641724527882506652",
                    "188702749759457363120972570225471975350",
                    "335352559520697964503703470903528144926",
                    "218975542163605580779584854593371779556",
                    "137591691809033937525256792378272001247",
                    "58842588577594266193200876452680762421",
                    "54395473412109098785461435680667127254",
                    "116003468230321547799027379498892699859",
                    "46258284087205771180421514880674817015",
                    "267656662058333552751125942154619144404",
                    "295902405144230405955990980847063049780",
                    "157345914817278339543940684369869078635",
                    "247771655723590564984157167542702336258"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/mctp/route.c"
            },
            "signature_type": "Line",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3c8fa54e904b0ddb52a08cc2d8ac239054f61fd",
            "deprecated": false,
            "signature_version": "v1",
            "id": "CVE-2024-27418-392e303d"
        },
        {
            "digest": {
                "line_hashes": [
                    "169154541564225413285292491794675047730",
                    "70077343444438639277775535874915579454",
                    "136597573669856433216641724527882506652",
                    "188702749759457363120972570225471975350",
                    "335352559520697964503703470903528144926",
                    "218975542163605580779584854593371779556",
                    "137591691809033937525256792378272001247",
                    "58842588577594266193200876452680762421",
                    "54395473412109098785461435680667127254",
                    "116003468230321547799027379498892699859",
                    "46258284087205771180421514880674817015",
                    "267656662058333552751125942154619144404",
                    "295902405144230405955990980847063049780",
                    "157345914817278339543940684369869078635",
                    "247771655723590564984157167542702336258"
                ],
                "threshold": 0.9
            },
            "target": {
                "file": "net/mctp/route.c"
            },
            "signature_type": "Line",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3773d65ae5154ed7df404b050fd7387a36ab5ef3",
            "deprecated": false,
            "signature_version": "v1",
            "id": "CVE-2024-27418-4995536f"
        },
        {
            "digest": {
                "length": 2058.0,
                "function_hash": "67329696690158115368203754178793330658"
            },
            "target": {
                "function": "mctp_local_output",
                "file": "net/mctp/route.c"
            },
            "signature_type": "Function",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3c8fa54e904b0ddb52a08cc2d8ac239054f61fd",
            "deprecated": false,
            "signature_version": "v1",
            "id": "CVE-2024-27418-b37235bc"
        },
        {
            "digest": {
                "length": 2058.0,
                "function_hash": "67329696690158115368203754178793330658"
            },
            "target": {
                "function": "mctp_local_output",
                "file": "net/mctp/route.c"
            },
            "signature_type": "Function",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3773d65ae5154ed7df404b050fd7387a36ab5ef3",
            "deprecated": false,
            "signature_version": "v1",
            "id": "CVE-2024-27418-d13abd99"
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
6.1.81
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.21
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.9