Executive Summary

This vulnerability exists in the Linux kernel's net subsystem, specifically in the mctp component. When a RTM_GETNEIGH request is made, the system may return uninitialized data in the padding bytes of the ndmsg data structure. This happens because the netlink response messages were not properly initialized to zero, potentially exposing leftover memory data.

The fix ensures that netlink data in link, address, and neighbor response messages are properly initialized to zero before being sent.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the unintended disclosure of kernel memory contents through the uninitialized padding bytes in netlink response messages. An attacker or user querying the RTM_GETNEIGH message could potentially access sensitive or leftover data from kernel memory, which might include information that should remain confidential.

Useful 0 Not Useful 0