CVE-2024-46865

In the Linux kernel, the following vulnerability has been resolved:

fou: fix initialization of grc

The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitialized.

Red Hat rates this flaw LOW impact. A use of an uninitialized variable was found in the Linux kernel's FOU/GUE (Foo over UDP) tunneling receive path in net/ipv4/fou_core.c. When the associated fou socket structure is NULL, the code jumps to the exit path and uses the uninitialized gro_cells pointer (grc), causing undefined behavior in the kernel packet receive/GRO path that can crash the kernel and cause a denial of service. Red Hat's assessment reflects a local attack vector requiring privileges with availability-only impact (CVSS 3.1: 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Within the current Red Hat product scope, only the Fedora kernel is affected, and the fix is pursued through the community kernel update process; Red Hat Enterprise Linux 6, 7, 8 and 9 kernel and kernel-rt, as well as the hosted OpenShift environments, are recorded as not affected, which is consistent with the upstream advisory showing that the regression was introduced only in specific upstream stable kernel point releases (5.10.226, 5.15.167, 6.1.110, 6.6.51, 6.10.10). The severity assigned by external parties differs from Red Hat's rating: NIST scores 7.1 and the CVE.org record scores 9.8 using a network attack vector, which does not match this flaw's local, privilege-gated receive-path code with availability-only impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.