CVE-2024-40985

net/tcp_ao: Don't leak ao_info on error-path

published July 12, 2024

CVSS
—
EPSS
0%
Percentile
13.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net/tcp_ao: Don't leak ao_info on error-path

It seems I introduced it together with TCP_AO_CMDF_AO_REQUIRED, on

version 5 [1] of TCP-AO patches. Quite frustrative that having all these

selftests that I've written, running kmemtest & kcov was always in todo.

[1]: https://lore.kernel.org/netdev/[email protected]/

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00235 · 13.7th percentile
Published
2024-07-12T12:37Z
EPSS history
Timeline
  • 12 JUL 12:37Z
    net/tcp_ao: Don't leak ao_info on error-path
    cvelistv5