Executive brief
A vulnerability was identified in the Linux kernel's networking component that handles secure IPv6 traffic. Under specific conditions, the system may attempt to access memory that does not exist, leading to a system crash or 'kernel panic.' This issue primarily impacts the availability of the system, potentially allowing a local user to cause a denial-of-service.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's IPv6 XFRM (IPsec) policy implementation. The function `xfrm6_get_saddr()` fails to validate the return value of `ip6_dst_idev()`, which can return NULL in certain network configurations or error states. When this occurs, the kernel attempts to dereference the NULL pointer to access the associated network device, resulting in a general protection fault and kernel oops. This was specifically observed during WireGuard handshake operations. The fix introduces a check to ensure `idev` is valid before use, returning `-EHOSTUNREACH` if it is NULL. Patches have been backported to multiple stable kernel versions.
Affected products
- Linux Linux Kernel Fixed in 6.10-rc2 and backported to various stable branches
Timeline
- 2024-06-15: patched: Initial fix authored by Eric Dumazet
- 2024-07-12: advisory: CVE-2024-40959 published
References
- https://git.kernel.org/stable/c/20427b85781aca0ad072851f6907a3d4b2fed8d1
- https://git.kernel.org/stable/c/600a62b4232ac027f788c3ca395bc2333adeaacf
- https://git.kernel.org/stable/c/83c02fb2cc0afee5bb53cddf3f34f045f654ad6a
- https://git.kernel.org/stable/c/9f30f1f1a51d91e19f5a09236bb0b59e6a07ad08
- https://git.kernel.org/stable/c/c71761292d4d002a8eccb57b86792c4e3b3eb3c7
- https://git.kernel.org/stable/c/caf0bec84c62fb1cf6f7c9f0e8c857c87f8adbc3
- https://git.kernel.org/stable/c/d46401052c2d5614da8efea5788532f0401cb164