Oracle Linux: CVE-2024-41046: ELSA-2024-12610: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Oracle Linux: CVE-2024-41046: ELSA-2024-12610: Unbreakable Enterprise kernel security update (IMPORTANT) (Multiple Advisories)

Severity

7

CVSS

(AV:L/AC:L/Au:S/C:C/I:C/A:C)

Published

07/29/2024

Created

11/13/2024

Added

10/16/2024

Modified

01/23/2025

Description

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times. A vulnerability was found in the Linux kernel where the Lantiq Ethernet driver could cause a double-free error due to improper handling of network packet descriptors. This issue occurs because the counter tracking released descriptors are not incremented correctly, leading to the same network packet buffer being released multiple times. This flaw can result in memory corruption, causing unexpected behavior, system crashes, or even creating opportunities for attackers to exploit the system.

Solution(s)

• oracle-linux-upgrade-kernel-uek

References

• https://attackerkb.com/topics/cve-2024-41046
• CVE - 2024-41046
• ELSA-2024-12610
• ELSA-2024-12618
• ELSA-2024-12779
• ELSA-2024-12612