CVE-2024-35976

In the Linux kernel, the following vulnerability has been resolved:

xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING

The Linux kernel CVE team has assigned CVE-2024-35976 to this issue.

Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052024-CVE-2024-35976-339b@gregkh/T

This vulnerability is rated as Low severity because triggering the out-of-bounds read requires local system access and elevated privileges (specifically CAP_NET_RAW) to open AF_XDP sockets. On default Red Hat Enterprise Linux deployments, unprivileged users cannot create the requisite socket type to interact with the vulnerable socket option handling. Consequently, the blast radius is confined to privileged local actors potentially causing a kernel denial of service, with no vector for unauthenticated remote exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.