SB2024053036 - Remote denial of service in Linux kernel ipv6
Published: May 30, 2024 Updated: May 14, 2025
Security Bulletin ID
SB2024053036
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Memory leak (CVE-ID: CVE-2021-47546)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within fib6_rule_suppress() function in net/ipv4/fib_rules.c. A remote attacker can send IPv6 packets to the system, trigger memory leak and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29
- https://git.kernel.org/stable/c/209d35ee34e25f9668c404350a1c86d914c54ffa
- https://git.kernel.org/stable/c/8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383
- https://git.kernel.org/stable/c/cdef485217d30382f3bf6448c54b4401648fe3f1
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.84
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.7
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.164