Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause significant system performance degradation or a denial-of-service condition. The issue stems from how the system handles the creation of new network namespaces, leading to excessive locking pressure that can stall networking operations. This could impact the availability of services and overall system responsiveness.
Technical details
A vulnerability in net/smc/smc_pnet.c occurs because smc_pnet_create_pnetids_list() unnecessarily acquires the Routing Netlink (rtnl) mutex during the initialization of new network namespaces, even when no network devices are present. This behavior creates extreme rtnl pressure and lock contention, as reported by syzbot. An attacker with local access could potentially exploit this by repeatedly triggering network namespace creation to exhaust system resources or stall networking tasks. The fix introduces an early return in smc_pnet_net_init() if the device list is empty, avoiding the unnecessary lock acquisition. Patches have been released for multiple stable kernel branches including 5.10, 6.1, 6.6, and 6.8.
Affected products
- Linux Linux Kernel up to 5.10.215, 5.16 to 6.1, 6.2 to 6.6.27, 6.7 to 6.8.6
Timeline
- 2024-03-05: patched: Initial patch committed to mainline kernel
- 2024-05-19: advisory: CVE-2024-35934 published
References
- https://git.kernel.org/stable/c/00af2aa93b76b1bade471ad0d0525d4d29ca5cc0
- https://git.kernel.org/stable/c/6e920422e7104928f760fc0e12b6d65ab097a2e7
- https://git.kernel.org/stable/c/a2e6bffc0388526ed10406040279a693d62b36ec
- https://git.kernel.org/stable/c/b9117dc783c0ab0a3866812f70e07bf2ea071ac4
- https://git.kernel.org/stable/c/bc4d1ebca11b4f194e262326bd45938e857c59d2
- https://git.kernel.org/stable/c/d7ee3bf0caf599c14db0bf4af7aacd6206ef8a23
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html