Junglewise Threat Intelligence

CVE-2024-35969: Linux Kernel race condition in IPv6 address management

CVE-2024-35969 · Severity: medium · CVSS 5.5 · Published 2024-05-20

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition vulnerability was identified in the Linux kernel's IPv6 networking component. This flaw occurs when the system simultaneously tries to retrieve and delete an IPv6 address, potentially leading to a system crash or instability. An attacker with local access could exploit this to cause a denial-of-service condition, impacting the availability of the affected system.

Technical details

A race condition exists between ipv6_get_ifaddr and ipv6_del_addr in the Linux kernel. While ipv6_get_ifaddr traverses the inet6_addr_lst under RCU lock, it can still retrieve an entry that is being concurrently removed and freed by ipv6_del_addr. If the timing is precise, ipv6_get_ifaddr may attempt to increment the reference count (in6_ifa_hold) of an object whose count has already reached zero, leading to a use-after-free or a refcount_t warning/saturate. The fix introduces in6_ifa_hold_safe (using refcount_inc_not_zero) to ensure the reference count is only incremented if the object is still valid. Patch availability is confirmed across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel All versions prior to the April 2024 patches

Timeline

  • 2024-04-08: other: Vulnerability fix authored
  • 2024-04-17: patched: Fix committed to stable kernel trees
  • 2024-05-20: advisory: CVE-2024-35969 published

References

Related threats