Overview
About vulnerability
In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this assumption. Initialize @arp pointer after dev_hard_header() call. A use-after-free vulnerability was found in the Linux kernel’s ARP implementation. The arp_create() function initializes a pointer to the ARP header before calling dev_hard_header(), incorrectly assuming that skb->head will not change. A recent kernel change broke this assumption, causing the @arp pointer to reference stale memory after dev_hard_header() potentially reallocates the socket buffer.Details
KernelCare state
Live-patch status from KernelCare for each operating system.
| Operating system | Status | Covered kernels |
|---|---|---|
| Oracle Linux 8 UEK 7 | Released |
85 kernels
|
| Oracle Linux 9 UEK 7 | Released |
85 kernels
|
| Proxmox VE 7 5.15 | Released |
47 kernels
|
| Ubuntu 20.04 HWE AWS | Released |
57 kernels
|
| Ubuntu 20.04 HWE Azure | Released |
40 kernels
|
| Ubuntu 22.04 | Released |
90 kernels
|
| Ubuntu 22.04 AWS | Released |
81 kernels
|
| Ubuntu 22.04 Azure | Released |
73 kernels
|