Description
iproute 2.4.7 and earlier allows local users to cause a denial of service via spoofed messages as other users to the kernel netlink interface.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | iproute | 20010824-8woody1 | DSA-492 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | iproute | 2.4.7-11.30E.1 | RHSA-2003:317 |
Advisories 2
- RHSA-2003:317 Red Hat Security Advisory: iproute security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-492 iproute - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2003:316 vendor-advisory
- DSA-492 vendor-advisory
- oval:org.mitre.oval:def:10912 vdb-entry signature
- RHSA-2003:317 vendor-advisory
- FEDORA-2004-115 vendor-advisory
- SUSE-SR:2005:001 vendor-advisory