CVE - CVE-2024-43873

CVE-ID
CVE-2024-43873	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacket_allow There are two issues around seqpacket_allow: 1. seqpacket_allow is not initialized when socket is created. Thus if features are never set, it will be read uninitialized. 2. if VIRTIO_VSOCK_F_SEQPACKET is set and then cleared, then seqpacket_allow will not be cleared appropriately (existing apps I know about don't usually do this but it's legal and there's no way to be sure no one relies on this). To fix: - initialize seqpacket_allow after allocation - set it unconditionally in set_features
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/1e1fdcbdde3b7663e5d8faeb2245b9b151417d22 URL:https://git.kernel.org/stable/c/1e1fdcbdde3b7663e5d8faeb2245b9b151417d22 MISC:https://git.kernel.org/stable/c/3062cb100787a9ddf45de30004b962035cd497fb URL:https://git.kernel.org/stable/c/3062cb100787a9ddf45de30004b962035cd497fb MISC:https://git.kernel.org/stable/c/30bd4593669443ac58515e23557dc8cef70d8582 URL:https://git.kernel.org/stable/c/30bd4593669443ac58515e23557dc8cef70d8582 MISC:https://git.kernel.org/stable/c/ea558f10fb05a6503c6e655a1b7d81fdf8e5924c URL:https://git.kernel.org/stable/c/ea558f10fb05a6503c6e655a1b7d81fdf8e5924c MISC:https://git.kernel.org/stable/c/eab96e8716cbfc2834b54f71cc9501ad4eec963b URL:https://git.kernel.org/stable/c/eab96e8716cbfc2834b54f71cc9501ad4eec963b
Assigning CNA
kernel.org
Date Record Created
20240817	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240817)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)