CVE-2024-41090 (GCVE-0-2024-41090)
Vulnerability from cvelistv5
Published
2024-07-29 06:18
Modified
2026-08-05 11:35
Severity ?
8.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be sent downstack. Even before the skb is transmitted, the tap_get_user_xdp()-->skb_set_network_header() may assume the size is more than ETH_HLEN. Once transmitted, this could either cause out-of-bound access beyond the actual length, or confuse the underlayer with incorrect or inconsistent header length in the skb metadata. In the alternative path, tap_get_user() already prohibits short frame which has the length less than Ethernet header size from being transmitted. This is to drop any frame shorter than the Ethernet header size just like how tap_get_user() does. CVE: CVE-2024-41090
References
Impacted products
Vendor Product Version
Linux Linux Version: 0efac27791ee068075d80f07c55a229b1335ce12
Version: 0efac27791ee068075d80f07c55a229b1335ce12
Version: 0efac27791ee068075d80f07c55a229b1335ce12
Version: 0efac27791ee068075d80f07c55a229b1335ce12
Version: 0efac27791ee068075d80f07c55a229b1335ce12
Version: 0efac27791ee068075d80f07c55a229b1335ce12
Version: 0efac27791ee068075d80f07c55a229b1335ce12
Version: 0efac27791ee068075d80f07c55a229b1335ce12
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:00:46.396Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-41090",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:24:59.280166Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:06.307Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8be915fc5ff9a5e296f6538be12ea75a1a93bdea",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "7431144b406ae82807eb87d8c98e518475b0450f",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "e5e5e63c506b93b89b01f522b6a7343585f784e6",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "ee93e6da30377cf2a75e16cd32bb9fcd86a61c46",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "aa6a5704cab861c9b2ae9f475076e1881e87f5aa",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "73d462a38d5f782b7c872fe9ae8393d9ef5483da",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "e1a786b9bbb767fd1c922d424aaa8078cc542309",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            },
            {
              "lessThan": "ed7f2afdd0e043a397677e597ced0830b83ba0b3",
              "status": "affected",
              "version": "0efac27791ee068075d80f07c55a229b1335ce12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/tap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.281",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.102",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.43",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.281",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.223",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.164",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.102",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.43",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.2",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntap: add missing verification for short frame\n\nThe cited commit missed to check against the validity of the frame length\nin the tap_get_user_xdp() path, which could cause a corrupted skb to be\nsent downstack. Even before the skb is transmitted, the\ntap_get_user_xdp()--\u003eskb_set_network_header() may assume the size is more\nthan ETH_HLEN. Once transmitted, this could either cause out-of-bound\naccess beyond the actual length, or confuse the underlayer with incorrect\nor inconsistent header length in the skb metadata.\n\nIn the alternative path, tap_get_user() already prohibits short frame which\nhas the length less than Ethernet header size from being transmitted.\n\nThis is to drop any frame shorter than the Ethernet header size just like\nhow tap_get_user() does.\n\nCVE: CVE-2024-41090"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only through vhost-net\u0027s batched XDP TX path, driven either by a guest VM\u0027s TX virtqueue on the same host or by a local process holding /dev/vhost-net plus a macvtap/ipvtap fd. Data arrives via shared memory rings, not from a remote network peer, so this is local rather than network access.\nAC:L - The attacker simply posts a TX descriptor whose payload is shorter than 14 bytes and kicks the virtqueue; vhost_net_build_xdp() only rejects len \u003c sock_hlen, so the short frame reaches tap_get_user_xdp() deterministically. The XDP batch path is active in the default QEMU configuration (unlimited sndbuf), and can be retried indefinitely.\nPR:L - The attacker must be an authorized guest VM on the host, or a local user with access to /dev/vhost-net and a tap/macvtap character device \u2014 some privilege, but nothing resembling host root. No CAP_SYS_ADMIN or init-namespace root is needed to trigger the path.\nUI:N - The malformed frame is processed entirely by the vhost worker kthread as soon as the guest kicks the ring; no host administrator or victim action is involved.\nS:C - A guest VM with zero host privileges corrupts host-kernel skb state and leaks host heap contents, crossing the guest/host virtualization boundary; the impacted resources (host kernel, physical NIC path, peer macvtap interfaces belonging to other tenants) lie outside the attacking guest\u0027s security authority.\nC:H - skb-\u003eprotocol is populated from eth_hdr() bytes that were never copied from the guest, exposing uninitialized page_frag memory that can contain remnants of previously transmitted host/other-guest packets, and the sub-ETH_HLEN skb causes downstream code to read beyond the actual frame length. The resulting memory-disclosure primitive is not bounded to a trivial value.\nI:H - A corrupted skb with network_header pointing past skb-\u003etail is passed to dev_queue_xmit(), so lower-layer drivers and offload code compute header lengths that underflow to enormous unsigned values, yielding out-of-bounds accesses and DMA/copy lengths attacker-influencing kernel memory. Such skb metadata corruption is leverageable for control-flow-relevant memory corruption.\nA:H - The out-of-bounds accesses and inconsistent header offsets in downstream network drivers readily produce a kernel oops or panic on the host, and the guest can repeat the trigger at will to keep the host down."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:18.598Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea"
        },
        {
          "url": "https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3"
        }
      ],
      "title": "tap: add missing verification for short frame",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-41090",
    "datePublished": "2024-07-29T06:18:10.896Z",
    "dateReserved": "2024-07-12T12:17:45.635Z",
    "dateUpdated": "2026-08-05T11:35:18.598Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:00:46.396Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-41090\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:24:59.280166Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:20.669Z\"}}], \"cna\": {\"title\": \"tap: add missing verification for short frame\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached only through vhost-net\u0027s batched XDP TX path, driven either by a guest VM\u0027s TX virtqueue on the same host or by a local process holding /dev/vhost-net plus a macvtap/ipvtap fd. Data arrives via shared memory rings, not from a remote network peer, so this is local rather than network access.\\nAC:L - The attacker simply posts a TX descriptor whose payload is shorter than 14 bytes and kicks the virtqueue; vhost_net_build_xdp() only rejects len \u003c sock_hlen, so the short frame reaches tap_get_user_xdp() deterministically. The XDP batch path is active in the default QEMU configuration (unlimited sndbuf), and can be retried indefinitely.\\nPR:L - The attacker must be an authorized guest VM on the host, or a local user with access to /dev/vhost-net and a tap/macvtap character device \\u2014 some privilege, but nothing resembling host root. No CAP_SYS_ADMIN or init-namespace root is needed to trigger the path.\\nUI:N - The malformed frame is processed entirely by the vhost worker kthread as soon as the guest kicks the ring; no host administrator or victim action is involved.\\nS:C - A guest VM with zero host privileges corrupts host-kernel skb state and leaks host heap contents, crossing the guest/host virtualization boundary; the impacted resources (host kernel, physical NIC path, peer macvtap interfaces belonging to other tenants) lie outside the attacking guest\u0027s security authority.\\nC:H - skb-\u003eprotocol is populated from eth_hdr() bytes that were never copied from the guest, exposing uninitialized page_frag memory that can contain remnants of previously transmitted host/other-guest packets, and the sub-ETH_HLEN skb causes downstream code to read beyond the actual frame length. The resulting memory-disclosure primitive is not bounded to a trivial value.\\nI:H - A corrupted skb with network_header pointing past skb-\u003etail is passed to dev_queue_xmit(), so lower-layer drivers and offload code compute header lengths that underflow to enormous unsigned values, yielding out-of-bounds accesses and DMA/copy lengths attacker-influencing kernel memory. Such skb metadata corruption is leverageable for control-flow-relevant memory corruption.\\nA:H - The out-of-bounds accesses and inconsistent header offsets in downstream network drivers readily produce a kernel oops or panic on the host, and the guest can repeat the trigger at will to keep the host down.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"0efac27791ee068075d80f07c55a229b1335ce12\", \"lessThan\": \"8be915fc5ff9a5e296f6538be12ea75a1a93bdea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0efac27791ee068075d80f07c55a229b1335ce12\", \"lessThan\": \"7431144b406ae82807eb87d8c98e518475b0450f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0efac27791ee068075d80f07c55a229b1335ce12\", \"lessThan\": \"e5e5e63c506b93b89b01f522b6a7343585f784e6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0efac27791ee068075d80f07c55a229b1335ce12\", \"lessThan\": \"ee93e6da30377cf2a75e16cd32bb9fcd86a61c46\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0efac27791ee068075d80f07c55a229b1335ce12\", \"lessThan\": \"aa6a5704cab861c9b2ae9f475076e1881e87f5aa\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0efac27791ee068075d80f07c55a229b1335ce12\", \"lessThan\": \"73d462a38d5f782b7c872fe9ae8393d9ef5483da\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0efac27791ee068075d80f07c55a229b1335ce12\", \"lessThan\": \"e1a786b9bbb767fd1c922d424aaa8078cc542309\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"0efac27791ee068075d80f07c55a229b1335ce12\", \"lessThan\": \"ed7f2afdd0e043a397677e597ced0830b83ba0b3\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/tap.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.281\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.223\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.164\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.102\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.43\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/tap.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8be915fc5ff9a5e296f6538be12ea75a1a93bdea\"}, {\"url\": \"https://git.kernel.org/stable/c/7431144b406ae82807eb87d8c98e518475b0450f\"}, {\"url\": \"https://git.kernel.org/stable/c/e5e5e63c506b93b89b01f522b6a7343585f784e6\"}, {\"url\": \"https://git.kernel.org/stable/c/ee93e6da30377cf2a75e16cd32bb9fcd86a61c46\"}, {\"url\": \"https://git.kernel.org/stable/c/aa6a5704cab861c9b2ae9f475076e1881e87f5aa\"}, {\"url\": \"https://git.kernel.org/stable/c/73d462a38d5f782b7c872fe9ae8393d9ef5483da\"}, {\"url\": \"https://git.kernel.org/stable/c/e1a786b9bbb767fd1c922d424aaa8078cc542309\"}, {\"url\": \"https://git.kernel.org/stable/c/ed7f2afdd0e043a397677e597ced0830b83ba0b3\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntap: add missing verification for short frame\\n\\nThe cited commit missed to check against the validity of the frame length\\nin the tap_get_user_xdp() path, which could cause a corrupted skb to be\\nsent downstack. Even before the skb is transmitted, the\\ntap_get_user_xdp()--\u003eskb_set_network_header() may assume the size is more\\nthan ETH_HLEN. Once transmitted, this could either cause out-of-bound\\naccess beyond the actual length, or confuse the underlayer with incorrect\\nor inconsistent header length in the skb metadata.\\n\\nIn the alternative path, tap_get_user() already prohibits short frame which\\nhas the length less than Ethernet header size from being transmitted.\\n\\nThis is to drop any frame shorter than the Ethernet header size just like\\nhow tap_get_user() does.\\n\\nCVE: CVE-2024-41090\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.281\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.223\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.164\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.102\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.43\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.12\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.2\", \"versionStartIncluding\": \"4.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"4.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:35:18.598Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-41090\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:35:18.598Z\", \"dateReserved\": \"2024-07-12T12:17:45.635Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-29T06:18:10.896Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.