CVE-2024-35941
CVE-2019-11247: Microsoft Windows NetBIOS Information Disclosure Vulnerability
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
INFO
Published Date :
May 19, 2024, 11:15 a.m.
Last Modified :
June 4, 2024, 1:15 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
Exploitability Score :
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-35941 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-35941 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Rejected by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 04, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 04, 2024
Action Type Old Value New Value Changed Description In the Linux kernel, the following vulnerability has been resolved: net: skbuff: add overflow debug check to pull/push helpers syzbot managed to trigger following splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x4a3b/0x5e50 Read of size 1 at addr ffff888208a4000e by task a.out/2313 [..] __skb_flow_dissect+0x4a3b/0x5e50 __skb_get_hash+0xb4/0x400 ip_tunnel_xmit+0x77e/0x26f0 ipip_tunnel_xmit+0x298/0x410 .. Analysis shows that the skb has a valid ->head, but bogus ->data pointer. skb->data gets its bogus value via the neigh layer, which does: 1556 __skb_pull(skb, skb_network_offset(skb)); ... and the skb was already dodgy at this point: skb_network_offset(skb) returns a negative value due to an earlier overflow of skb->network_header (u16). __skb_pull thus "adjusts" skb->data by a huge offset, pointing outside skb->head area. Allow debug builds to splat when we try to pull/push more than INT_MAX bytes. After this, the syzkaller reproducer yields a more precise splat before the flow dissector attempts to read off skb->data memory: WARNING: CPU: 5 PID: 2313 at include/linux/skbuff.h:2653 neigh_connected_output+0x28e/0x400 ip_finish_output2+0xb25/0xed0 iptunnel_xmit+0x4ff/0x870 ipgre_xmit+0x78e/0xbb0 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed Reference kernel.org https://git.kernel.org/stable/c/8af60bb2b215f478b886f1d6d302fefa7f0b917d Removed Reference kernel.org https://git.kernel.org/stable/c/1b2b26595bb09febf14c5444c873ac4ec90a5a77 Removed Reference kernel.org https://git.kernel.org/stable/c/fff05b2b004d9a8a2416d08647f3dc9068e357c8 Removed Reference kernel.org https://git.kernel.org/stable/c/219eee9c0d16f1b754a8b85275854ab17df0850a -
CVE Translated by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 04, 2024
Action Type Old Value New Value Removed Translation Title: kernel de Linux Description: En el kernel de Linux, se resolvió la siguiente vulnerabilidad: net: skbuff: agregar verificación de depuración de desbordamiento a los asistentes de extracción/empuje syzbot logró activar el siguiente símbolo: BUG: KASAN: use after free en __skb_flow_dissect+0x4a3b/0x5e50 Lectura de tamaño 1 en la dirección ffff888208a4000e por tarea a.out/2313 [..] __skb_flow_dissect+0x4a3b/0x5e50 __skb_get_hash+0xb4/0x400 ip_tunnel_xmit+0x77e/0x26f0 ipip_tunnel_xmit+0x298/0x410 .. El análisis muestra que el skb tiene un ->head válido, pero falso ->puntero de datos. skb->data obtiene su valor falso a través de la capa vecina, que hace: 1556 __skb_pull(skb, skb_network_offset(skb)); ... y el skb ya era dudoso en este punto: skb_network_offset(skb) devuelve un valor negativo debido a un desbordamiento anterior de skb->network_header (u16). __skb_pull por lo tanto "ajusta" los datos skb-> con un desplazamiento enorme, apuntando fuera del área principal de skb->. Permitir que las compilaciones de depuración se ejecuten cuando intentamos extraer/enviar más de INT_MAX bytes. Después de esto, el reproductor syzkaller produce un sonido más preciso antes de que el disector de flujo intente leer skb->memoria de datos: ADVERTENCIA: CPU: 5 PID: 2313 en include/linux/skbuff.h:2653 neigh_connected_output+0x28e/0x400 ip_finish_output2+ 0xb25/0xed0 iptunnel_xmit+0x4ff/0x870 ipgre_xmit+0x78e/0xbb0 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 19, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net: skbuff: add overflow debug check to pull/push helpers syzbot managed to trigger following splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x4a3b/0x5e50 Read of size 1 at addr ffff888208a4000e by task a.out/2313 [..] __skb_flow_dissect+0x4a3b/0x5e50 __skb_get_hash+0xb4/0x400 ip_tunnel_xmit+0x77e/0x26f0 ipip_tunnel_xmit+0x298/0x410 .. Analysis shows that the skb has a valid ->head, but bogus ->data pointer. skb->data gets its bogus value via the neigh layer, which does: 1556 __skb_pull(skb, skb_network_offset(skb)); ... and the skb was already dodgy at this point: skb_network_offset(skb) returns a negative value due to an earlier overflow of skb->network_header (u16). __skb_pull thus "adjusts" skb->data by a huge offset, pointing outside skb->head area. Allow debug builds to splat when we try to pull/push more than INT_MAX bytes. After this, the syzkaller reproducer yields a more precise splat before the flow dissector attempts to read off skb->data memory: WARNING: CPU: 5 PID: 2313 at include/linux/skbuff.h:2653 neigh_connected_output+0x28e/0x400 ip_finish_output2+0xb25/0xed0 iptunnel_xmit+0x4ff/0x870 ipgre_xmit+0x78e/0xbb0 Added Reference kernel.org https://git.kernel.org/stable/c/8af60bb2b215f478b886f1d6d302fefa7f0b917d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/1b2b26595bb09febf14c5444c873ac4ec90a5a77 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/fff05b2b004d9a8a2416d08647f3dc9068e357c8 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/219eee9c0d16f1b754a8b85275854ab17df0850a [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2024-35941 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2024-35941
weaknesses.