Junglewise Threat Intelligence

CVE-2024-26855: Linux Kernel NULL pointer dereference in ice_bridge_setlink

CVE-2024-26855 · Severity: medium · CVSS 5.5 · Published 2024-04-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Intel 'ice' network driver. This driver is responsible for managing high-speed Intel Ethernet network interfaces. An attacker with local access to the system could trigger a system crash (denial of service) by exploiting a flaw in how the driver handles specific network configuration messages, potentially impacting the availability of the server or workstation.

Technical details

A NULL pointer dereference vulnerability exists in the Linux kernel's 'ice' driver within the ice_bridge_setlink() function. The issue occurs because the code fails to validate the return value of nlmsg_find_attr() before passing it to nla_for_each_nested(). If the expected IFLA_AF_SPEC attribute is missing from a Netlink message, the br_spec pointer remains NULL, leading to a kernel oops when dereferenced. This can be triggered by a local user with sufficient privileges to send Netlink configuration messages. Patches have been released across multiple stable kernel branches to ensure br_spec is validated before use.

Affected products

  • Linux Linux Kernel 4.20 to 5.4.272, 5.5 to 5.10.213, 5.11 to 5.15.152, 5.16 to 6.1.82, 6.2 to 6.6.22, 6.7 to 6.7.10, 6.8-rc1 to 6.8-rc6

Timeline

  • 2024-04-17: advisory: Initial disclosure of CVE-2024-26855
  • 2024-03-15: patched: Fixes merged into various stable kernel branches

References

Related threats