Junglewise Threat Intelligence

CVE-2024-38558: Linux Kernel Open vSwitch metadata corruption in ICMPv6 parsing

CVE-2024-38558 · Severity: medium · CVSS 5.5 · Published 2024-06-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Open vSwitch component could allow a local attacker to cause network traffic to be processed incorrectly. Open vSwitch is a virtual switch used to manage network traffic between virtual machines and physical networks. By triggering a specific error in how ICMPv6 packets are handled, an attacker could cause the system to misidentify network connections, potentially leading to service disruptions or the execution of incorrect security actions.

Technical details

A vulnerability exists in the Open vSwitch (OVS) datapath implementation within the Linux kernel where ICMPv6 packet parsing can overwrite connection tracking (conntrack) metadata. Specifically, in the OVS_PACKET_CMD_EXECUTE path, the 'ipv6' union in the sw_flow_key structure shares memory between Neighbor Discovery (ND) fields and the 'ct_orig' tuple. The code was unconditionally zeroing out the ND fields when parsing any ICMPv6 header, which inadvertently wiped the destination address of the original conntrack tuple for non-ND ICMPv6 packets (like Echo requests). This corruption can lead to incorrect flow matching and the execution of unintended actions if the packet is recirculated or sent to userspace. The fix restricts the memset operation to actual ND packets.

Affected products

  • Linux Linux Kernel 4.11 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3

Timeline

  • 2024-05-09: patched: Initial fix authored by Ilya Maximets
  • 2024-06-19: disclosed: CVE-2024-38558 published

References

Related threats