CVE-2024-35888

In the Linux kernel, the following vulnerability has been resolved:

erspan: make sure erspan_base_hdr is present in skb->head

The Linux kernel CVE team has assigned CVE-2024-35888 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051947-CVE-2024-35888-1e04@gregkh/T

This vulnerability is rated as Low severity because exploitation requires processing malformed ERSPAN traffic over GRE tunnels or crafting packet headers through local network interfaces, limiting the attack surface to specialized network configurations. While an out-of-bounds read can cause a kernel crash leading to a denial of service, it does not permit privilege escalation or remote code execution. Additionally, ERSPAN encapsulation is not enabled or utilized in typical Red Hat Enterprise Linux deployments by default.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.