Junglewise Threat Intelligence

CVE-2024-39489: Linux Kernel memory leak in IPv6 Segment Routing HMAC

CVE-2024-39489 · Severity: medium · CVSS 5.5 · Published 2024-07-10

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's IPv6 implementation could allow a local user to cause a memory leak. This occurs when the system fails to properly clean up resources during certain networking configuration tasks. Over time, repeated exploitation could exhaust system memory, leading to a denial-of-service condition where the system becomes unstable or crashes.

Technical details

A memory leak exists in the 'seg6_hmac_init_algo' function within the IPv6 Segment Routing (SR) component of the Linux kernel. The vulnerability is caused by a failure to release previously allocated memory and crypto transforms (tfms) if a subsequent allocation fails during the initialization of HMAC algorithms. An attacker with local access could potentially trigger this leak repeatedly to exhaust system memory, leading to a denial of service. The fix involves updating 'seg6_hmac_exit' to safely free memory only when it has been successfully allocated, allowing for proper cleanup during initialization failures. Patch sets have been released for various stable kernel branches.

Affected products

  • Linux Linux Kernel 4.10 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.9.4

Timeline

  • 2024-07-10: advisory: Initial publication of the CVE record
  • 2024-05-17: patched: Fix submitted to the Linux kernel tree

References

Related threats