Executive brief
A vulnerability in the Linux kernel's IPv6 implementation could allow a local user to cause a memory leak. This occurs when the system fails to properly clean up resources during certain networking configuration tasks. Over time, repeated exploitation could exhaust system memory, leading to a denial-of-service condition where the system becomes unstable or crashes.
Technical details
A memory leak exists in the 'seg6_hmac_init_algo' function within the IPv6 Segment Routing (SR) component of the Linux kernel. The vulnerability is caused by a failure to release previously allocated memory and crypto transforms (tfms) if a subsequent allocation fails during the initialization of HMAC algorithms. An attacker with local access could potentially trigger this leak repeatedly to exhaust system memory, leading to a denial of service. The fix involves updating 'seg6_hmac_exit' to safely free memory only when it has been successfully allocated, allowing for proper cleanup during initialization failures. Patch sets have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 4.10 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.9.4
Timeline
- 2024-07-10: advisory: Initial publication of the CVE record
- 2024-05-17: patched: Fix submitted to the Linux kernel tree
References
- https://git.kernel.org/stable/c/0e44d6cbe8de983470c3d2f978649783384fdcb6
- https://git.kernel.org/stable/c/4a3fcf53725b70010d1cf869a2ba549fed6b8fb3
- https://git.kernel.org/stable/c/599a5654215092ac22bfc453f4fd3959c55ea821
- https://git.kernel.org/stable/c/61d31ac85b4572d11f8071855c0ccb4f32d76c0c
- https://git.kernel.org/stable/c/afd5730969aec960a2fee4e5ee839a6014643976
- https://git.kernel.org/stable/c/daf341e0a2318b813427d5a78788c86f4a7f02be
- https://git.kernel.org/stable/c/efb9f4f19f8e37fde43dfecebc80292d179f56c6