CVE-2024-49940: linux kernel before 6.11.3 (exclusive); +1 more affected products

Affected technology

linux kernel · before 6.11.3 (exclusive)
linux

Linux · 3953ae7b218df4d1e544b98a393666f9ae58a78c to before 98691b2e28a6c3dac0680914493d54c77f215755, 3953ae7b218df4d1e544b98a393666f9ae58a78c to before f7415e60c25a6108cd7955a20b2e66b6251ffe02, 3953ae7b218df4d1e544b98a393666f9ae58a78c to before 24256415d18695b46da06c93135f5b51c548b950, b102bfc2a90d14f342580285782a9a51c74f7369, 10c15ddabbcf888922adbdd44ca3fecf6eab19d9, 8d1c650d452c53fcb3f02a7b1d772741639f89a4, 12b5fb58ac993c24210cf8cbc72d407d3a4e6490, aef37401b467a0b1a9517c69924a1d66937e0789, 3.2.99 to before 3.3, 3.16.54 to before 3.17, 4.4.225 to before 4.5, 4.9.225 to before 4.10, 4.14.182 to before 4.15
Linux

Linux · 4.15
Linux

Component: Not specified by the source
File: net/l2tp/l2tp_core.c, net/l2tp/l2tp_core.h, net/l2tp/l2tp_netlink.c, net/l2tp/l2tp_ppp.c

Attack conditions (Source advisory, CVSS 3.1): Local · Low privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 3.1 assessment (base score 7.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 5.5/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.