Executive brief
A vulnerability in the Linux kernel's batman-adv mesh networking protocol can lead to a system hang or denial of service. When network interface settings like the Maximum Transmission Unit (MTU) are set too low, the system enters an infinite loop while trying to reorganize internal routing tables. This results in the system becoming unresponsive and flooding system logs with error messages.
Technical details
A vulnerability exists in the 'batadv_tt_local_resize_to_mtu' function within the batman-adv (B.A.T.M.A.N. Advanced) kernel module. When the MTU of an attached interface is reduced below a specific threshold—specifically when it is too small to accommodate even the basic header and VLAN-specific parts of the translation table—the resizing logic fails to terminate. The root cause is a 'while(true)' loop that relies on a timeout value that can stagnate at zero, preventing the loop from exiting when the table cannot be reduced further. An attacker with local privileges to modify network configurations or trigger MTU changes could exploit this to cause a kernel hang (Denial of Service). The fix replaces the infinite loop condition with a check on the timeout variable.
Affected products
- Linux Linux Kernel 3.13 to 6.8.x
Timeline
- 2024-02-12: patched: Initial patch authored
- 2024-05-20: disclosed: CVE published
References
- https://git.kernel.org/stable/c/04720ea2e6c64459a90ca28570ea78335eccd924
- https://git.kernel.org/stable/c/3fe79b2c83461edbbf86ed8a6f3924820ff89259
- https://git.kernel.org/stable/c/4ca2a5fb54ea2cc43edea614207fcede562d91c2
- https://git.kernel.org/stable/c/70a8be9dc2fb65d67f8c1e0c88c587e08e2e575d
- https://git.kernel.org/stable/c/87b6af1a7683e021710c08fc0551fc078346032f
- https://git.kernel.org/stable/c/b1f532a3b1e6d2e5559c7ace49322922637a28aa
- https://git.kernel.org/stable/c/b3ddf6904073990492454b1dd1c10a24be8c74c6