Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when the system processes certain IPv6 routing rules, leading to a 'null pointer dereference' that causes a kernel panic. This results in a complete loss of system availability, potentially disrupting operations and requiring a reboot.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's IPv6 implementation within the `fib6_rule_action()` function in `net/ipv6/fib6_rules.c`. The root cause is the unsafe use of `ip6_dst_idev()`, which can return NULL under certain conditions, such as during specific SCTP connection attempts or complex routing lookups. A local attacker can trigger this by initiating network traffic that exercises these specific IPv6 routing paths, leading to a general protection fault and kernel crash. The vulnerability has been addressed by adding a NULL check for the `idev` structure before it is dereferenced. Fixes are available in various stable kernel branches.
Affected products
- Linux Linux Kernel 6.9.0-rc4-next-20240417-syzkaller
Timeline
- 2024-05-07: patched: Initial patch authored by Eric Dumazet
- 2024-05-30: advisory: CVE-2024-36902 published in NVD
References
- https://git.kernel.org/stable/c/1876881c9a49613b5249fb400cbf53412d90cb09
- https://git.kernel.org/stable/c/35297fc68de36826087e976f86a5b1f94fd0bf95
- https://git.kernel.org/stable/c/4a5a573387da6a6b23a4cc62147453ff1bc32afa
- https://git.kernel.org/stable/c/674c951ab8a23f7aff9b4c3f2f865901bc76a290
- https://git.kernel.org/stable/c/7e3242c139c38e60844638e394c2877b16b396b0
- https://git.kernel.org/stable/c/8745a8d74ba17dafe72b6ab461fa6c007d879747
- https://git.kernel.org/stable/c/d101291b2681e5ab938554e3e323f7a7ee33e3aa