tap: add missing verification for short frame (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.26 % · percentile 17 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted. This is to drop any frame shorter than the Ethernet header size just like how tap_get_user() does. CVE: CVE-2024-41090
Weaknesses (CWE)
- CWE-125 — Out-of-bounds Read
References
- https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea
- https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f
- https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6
- https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46
- https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa
- https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da
- https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309
- https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-38887
- GCVE · GCVE-0-2024-41090
CERT-FR advisories
- CERTFR-2026-AVI-1165 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0677 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0336 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0022 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0002 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1080 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1013 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0997 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0957 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0821 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0749 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0728 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0719 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0717 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0695 — Multiples vulnérabilités dans le noyau Linux de Red Hat · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0669 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.281cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.223cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.164cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.102cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.6.43cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.7 < 6.9.12cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.10 < 6.10.2
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 0efac27791ee068075d80f07c55a229b1335ce12 < 8be915fc5ff9a5e296f6538be12ea75a1a93bdea ; affected 0efac27791ee068075d80f07c55a229b1335ce12 < 7431144b406ae82807eb87d8c98e518475b0450f ; affected 0efac27791ee068075d80f07c55a229b1335ce12 < e5e5e63c506b93b89b01f522b6a7343585f784e6 ; affected 0efac27791ee068075d80f07c55a229b1335ce12 < ee93e6da30377cf2a75e16cd32bb9fcd86a61c46 ; affected 0efac27791ee068075d80f07c55a229b1335ce12 < aa6a5704cab861c9b2ae9f475076e1881e87f5aa ; affected 0efac27791ee068075d80f07c55a229b1335ce12 < 73d462a38d5f782b7c872fe9ae8393d9ef5483da |
| Linux · Linux | affected 4.20 ; unaffected 0 < 4.20 ; unaffected 5.4.281 ≤ 5.4.* ; unaffected 5.10.223 ≤ 5.10.* ; unaffected 5.15.164 ≤ 5.15.* ; unaffected 6.1.102 ≤ 6.1.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |