Executive brief
The Linux kernel contains a NULL pointer dereference vulnerability in UDP-Lite socket handling when memory allocation functions are invoked. An attacker can trigger this by creating a UDP-Lite socket with specific parameters, causing a kernel panic that disrupts system availability. This affects systems running vulnerable kernel versions and can lead to denial of service.
Technical details
The vulnerability is a NULL pointer dereference in the __sk_mem_raise_allocated() function within net/core/sock.c, triggered through UDP-Lite (IPPROTO_UDPLITE, protocol 0x88) socket creation. The root cause is missing initialization of the .sysctl_rmem_offset field for udplite_prot and udplitev6_prot structures, causing sk_get_rmem0() to dereference a NULL pointer when memory allocation functions query socket receive buffer configuration. An unauthenticated network attacker can exploit this by crafting a socket creation request without requiring any special privileges or user interaction. A successful exploit results in a kernel panic (general protection fault), causing a denial of service. The fix involves setting the .sysctl_wmem_offset (or .sysctl_rmem) field to match UDP's configuration, aligning with a previous similar fix (commit c915fe13cbaa).
Affected products
- Linux Linux kernel 6.4.0-rc2 and likely earlier versions; patched after CVE-2023-54004 disclosure
Timeline
- 2025-12-24: disclosed