In the Linux kernel, the following vulnerability has been resolved:
batman-adv: bla: reacquire gw address after skb realloc
The pskb_may_pull() called by batadv_bla_is_backbone_gw() could reallocate
the buffer behind the skb. Variables which were pointing to the old buffer
need to be reassigned to avoid an use-after-free.
Attack Parameters
Attack Vector
Adjacent
Requires local network access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/41819c5467b6eb8ab4567f0ac98702ce9b6abbb1
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4a6673c55752a7aa41e28f51660eb981504ca088
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/a9ab19fbca86b32e9a9ae9e1a63e70a7eab3400f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ab2bac47a02637df1128a151e81d3ec14767f4bb
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/cdf3b5af2bc4431e58629e8ad2086b1e9185c761
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dc16bbf53cede1baf564bf0c8a861114b64e18b3
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e5e18886aadd3870e2d84e32a9678317fab1dd9e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/f4fb97ecf677cd9c3aa4f3bfc6fbf5b0e4bdbbbf
416baaa9-dc9f-4396-8d5f-8c081fb06d67