Junglewise Threat Intelligence

CVE-2024-26596: Linux kernel slab-out-of-bounds read in DSA netdevice events

CVE-2024-26596 · Severity: medium · CVSS 5.5 · Published 2024-02-23

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs when the system processes specific network configuration changes on virtual interfaces, leading to an invalid memory access. This results in a kernel 'oops' or crash, impacting the availability of the server or device.

Technical details

A vulnerability exists in the Linux kernel's net/dsa component due to an improper dereference of netdev_priv() before performing a type check. Specifically, in dsa_user_to_port(), the code attempts to access a dsa_user_priv structure for every NETDEV_CHANGEUPPER and NETDEV_PRECHANGEUPPER event, regardless of whether the device is a DSA device. While most drivers allocate enough private memory to avoid a fault, 'dummy' interfaces with zero-sized private data cause a slab-out-of-bounds read. A local attacker can trigger this by creating a dummy interface and adding a VLAN upper device, leading to a kernel oops and denial of service. The issue has been patched by moving the dereference after the dsa_user_dev_check() call.

Affected products

  • Linux Linux kernel 6.1.0 to 6.7.2

Timeline

  • 2024-01-11: patched: Mainline kernel patch committed
  • 2024-02-23: advisory: CVE-2024-26596 published

References

Related threats