Threats tagged 'ghsa-4jrj-q762-xjh5'

A use-after-free vulnerability in the Linux kernel's VXLAN multicast database (mdb) handling was resolved. The flaw occurs in vxlan_mdb_remote_src_del() when processing certain multicast source entries with an all-zeros address, leading to a double free and potential memory corruption. This issue affects specific Linux kernel versions used in the linux-hwe-edge product. The vulnerability has a CVSS score of 7.8, indicating a medium severity level with high impact on confidentiality, integrity, and availability. The fix involves rejecting the all-zeros address in the validation function to prevent the erroneous condition. The vulnerability can be triggered by unprivileged users in new user and network namespaces due to the netns-scoped MDB operations. No known exploits are reported in the wild.