Junglewise Threat Intelligence

CVE-2024-38612: Linux Kernel use-after-free in IPv6 Segment Routing initialization

CVE-2024-38612 · Severity: critical · CVSS 9.8 · Published 2024-06-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's IPv6 implementation could allow an attacker to cause a system crash or potentially execute unauthorized code. The issue occurs during the initialization of Segment Routing (SR) features when certain configuration options are disabled, leading to improper memory management. This could result in service outages or compromise of the affected server.

Technical details

A vulnerability exists in the seg6_init() function within net/ipv6/seg6.c of the Linux kernel. When CONFIG_IPV6_SEG6_LWTUNNEL is not defined and seg6_hmac_init() fails, the kernel fails to call genl_unregister_family(), leading to an invalid unregister error path. This flaw can result in a use-after-free or a NULL pointer dereference. An attacker could potentially exploit this to cause a kernel panic (DoS) or achieve arbitrary code execution. The issue has been addressed by ensuring genl_unregister_family() is correctly called regardless of the LWTUNNEL configuration when HMAC initialization fails.

Affected products

  • Linux Linux Kernel 4.10 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3

Timeline

  • 2024-05-09: other: Patch submitted by Hangbin Liu
  • 2024-06-16: patched: Patch committed to stable trees
  • 2024-06-19: advisory: CVE published

References