Executive brief
A race condition vulnerability was identified in the Linux kernel's IPv6 networking component. This flaw occurs when the system simultaneously tries to retrieve and delete an IPv6 address, potentially leading to a system crash or instability. An attacker with local access could exploit this to cause a denial-of-service condition, impacting the availability of the affected system.
Technical details
A race condition exists between ipv6_get_ifaddr and ipv6_del_addr in the Linux kernel. While ipv6_get_ifaddr traverses the inet6_addr_lst under RCU lock, it can still retrieve an entry that is being concurrently removed and freed by ipv6_del_addr. If the timing is precise, ipv6_get_ifaddr may attempt to increment the reference count (in6_ifa_hold) of an object whose count has already reached zero, leading to a use-after-free or a refcount_t warning/saturate. The fix introduces in6_ifa_hold_safe (using refcount_inc_not_zero) to ensure the reference count is only incremented if the object is still valid. Patch availability is confirmed across multiple stable kernel branches.
Affected products
- Linux Linux Kernel All versions prior to the April 2024 patches
Timeline
- 2024-04-08: other: Vulnerability fix authored
- 2024-04-17: patched: Fix committed to stable kernel trees
- 2024-05-20: advisory: CVE-2024-35969 published
References
- https://git.kernel.org/stable/c/01b11a0566670612bd464a932e5ac2eae53d8652
- https://git.kernel.org/stable/c/3fb02ec57ead2891a2306af8c51a306bc5945e70
- https://git.kernel.org/stable/c/4b19e9507c275de0cfe61c24db69179dc52cf9fb
- https://git.kernel.org/stable/c/6cdb20c342cd0193d3e956e3d83981d0f438bb83
- https://git.kernel.org/stable/c/7633c4da919ad51164acbf1aa322cc1a3ead6129
- https://git.kernel.org/stable/c/b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1
- https://git.kernel.org/stable/c/cca606e14264098cba65efa82790825dbf69e903