Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash. The issue occurs within the Netfilter TProxy module, which is used for transparently redirecting network traffic. If an attacker triggers a specific networking condition on a device where IP has been disabled, it can lead to a kernel panic and a total denial of service for the affected system.
Technical details
A NULL pointer dereference exists in the nf_tproxy_laddr4 function within net/ipv4/netfilter/nf_tproxy_ipv4.c. The vulnerability is triggered because __in_dev_get_rcu() can return NULL if IP has been disabled on the network device, but the code fails to validate this return value before use. An attacker with local access can exploit this to trigger a general protection fault (GPF), leading to a kernel panic and denial of service. The issue has been addressed by adding a check to bail out and return the destination address if the device pointer is NULL.
Affected products
- Linux Linux Kernel 2.6.37 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.9.4, 6.10-rc1
Timeline
- 2024-05-29: patched: Mainline kernel patch committed
- 2024-06-21: disclosed: CVE published
References
- https://git.kernel.org/stable/c/07eeedafc59c45fe5de43958128542be3784764c
- https://git.kernel.org/stable/c/10f0af5234dafd03d2b75233428ec3f11cf7e43d
- https://git.kernel.org/stable/c/21a673bddc8fd4873c370caf9ae70ffc6d47e8d3
- https://git.kernel.org/stable/c/570b4c52096e62fda562448f5760fd0ff06110f0
- https://git.kernel.org/stable/c/6fe5af4ff06db3d4d80e07a19356640428159f03
- https://git.kernel.org/stable/c/819bfeca16eb9ad647ddcae25e7e12c30612147c
- https://git.kernel.org/stable/c/caf3a8afb5ea00db6d5398adf148d5534615fd80