CVE-2024-56648

Summary

CVE-2024-56648 is a vulnerability affecting the Linux kernel's hsr (HSRP and VRRP helper) module. The issue lies in the function fill_frame_info(), which does not properly check the length of a packet, allowing a malicious actor to feed a packet of 14 bytes longer than expected. This can result in out-of-bound access, leading to uninitialized memory being read. The vulnerability exists in several functions, including netdev_start_xmit and packet_sendmsg, and can be triggered through socket calls. The affected memory was allocated using the slab allocator. This vulnerability has been resolved in the latest Linux kernel.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.