Junglewise Threat Intelligence

CVE-2024-35888: Linux Kernel uninitialized value read in ERSPAN protocol handler

CVE-2024-35888 · Severity: medium · CVSS 5.5 · Published 2024-05-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's networking component responsible for ERSPAN (Encapsulated Remote Switched Port Analyzer) traffic. This component is used to mirror network traffic for monitoring and analysis. An attacker could exploit this flaw to cause a system crash or instability, potentially leading to a denial of service.

Technical details

A vulnerability exists in the ip6erspan_rcv() and erspan_rcv() functions within the Linux kernel's GRE/ERSPAN implementation. The issue stems from a failure to call pskb_may_pull() to ensure the ERSPAN base header (erspan_base_hdr) is present in the linear part of the socket buffer (skb->head) before accessing the version field. This results in an uninitialized value read, as reported by syzbot's Kernel Memory Sanitizer (KMSAN). An attacker with the ability to send specially crafted ERSPAN packets could trigger this flaw to cause a kernel panic or denial of service. Patches have been released across multiple stable kernel branches to include the missing pskb_may_pull() checks.

Affected products

  • Linux Linux Kernel 5.5 to 5.10.215, 5.11 to 5.15.154, 6.2 to 6.6.26, 6.7 to 6.8.5

Timeline

  • 2024-03-28: patched: Initial fix authored by Eric Dumazet
  • 2024-05-19: advisory: CVE-2024-35888 published

References

Related threats