The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Oct 3, 2012 |
| Suse | — | Upgrade kernel-sourceUpgrade kernel-default-extraUpgrade kernel-default-develUpgrade kernel-macrosUpgrade kernel-symsUpgrade kernel-vanilla-baseUpgrade kernel-docsUpgrade kernel-default-manUpgrade reiserfs-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-develUpgrade kernel-defaultUpgrade kernel-default-base | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade linux-image-3.2.0-32-genericUpgrade linux-image-3.2.0-32-generic-paeUpgrade linux-image-3.2.0-32-virtualUpgrade linux-image-3.2.0-1420-omap4Upgrade linux-image-3.2.0-32-highbankUpgrade linux-image-3.2.0-32-powerpc-smpUpgrade linux-image-3.2.0-32-powerpc64-smpUpgrade linux-image-3.2.0-32-omap | Nov 8, 2024 | Oct 3, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub