Junglewise Threat Intelligence

CVE-2024-35884: Linux Kernel denial of service in UDP tunnel GSO handling

CVE-2024-35884 · Severity: medium · CVSS 5.5 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user or network traffic to cause a system crash. The issue occurs when the system incorrectly processes certain types of tunneled network data, leading to internal errors. This can result in a denial-of-service condition, impacting the availability of the affected server or device.

Technical details

The vulnerability exists in the UDP Generic Receive Offload (GRO) and Generic Segmentation Offload (GSO) logic. When 'rx-udp-gro-forwarding' is enabled, UDP packets may be aggregated (GROed) even if they are destined for a tunnel. The check in 'udp_gro_receive' to prevent this only looks for matching sockets in the current network namespace (netns). If the tunnel endpoint resides in a different netns, packets are incorrectly aggregated at the UDP level. When these packets later reach the tunnel receive path (e.g., Geneve), headers are pulled without adjusting the 'frag_list' offsets, leading to incorrect 'gso_size' values. This mismatch causes 'skb_segment' to misinterpret packet data, triggering kernel BUG_ON assertions or memory corruption. The fix extends 'udp_unexpected_gso' to ensure GSO packets lacking tunnel-specific flags are properly segmented before entering a tunnel.

Affected products

  • Linux Linux Kernel 5.6 to 5.10.215, 5.11 to 5.15.154, 5.16 to 6.1.85, 6.2 to 6.6.26, 6.7 to 6.8.5, 6.9-rc1, 6.9-rc2

Timeline

  • 2024-03-26: patched: Initial patch authored by Antoine Tenart
  • 2024-05-19: disclosed: CVE published

References

Related threats