Executive brief
A vulnerability was identified in the Linux kernel's IPv6 networking component that could allow a local user to crash the system. The issue occurs when the system attempts to probe network routes and encounters an unexpected empty data structure. This results in a system 'oops' or kernel panic, leading to a denial-of-service condition that disrupts operations and availability.
Technical details
A NULL pointer dereference vulnerability exists in the Linux kernel's IPv6 routing subsystem within the rt6_probe() function in net/ipv6/route.c. The root cause is a failure to validate the return value of __in6_dev_get(dev) before dereferencing it. An attacker with local access can trigger this code path (e.g., via rawv6_sendmsg) to cause a general protection fault or kernel panic. The vulnerability was discovered using syzbot and has been addressed by adding a check to bail out if __in6_dev_get() returns NULL. Patches are available across multiple stable kernel branches.
Affected products
- Linux Linux Kernel Fixed in 6.10-rc2 and various stable branches (e.g., 6.9.8, 6.6.37, 6.1.97)
Timeline
- 2024-06-15: patched: Initial patch authored by Eric Dumazet
- 2024-07-12: advisory: CVE-2024-40960 published
References
- https://git.kernel.org/stable/c/1ed9849fdf9a1a617129346b11d2094ca26828dc
- https://git.kernel.org/stable/c/51ee2f7c30790799d0ec30c0ce0c743e58f046f2
- https://git.kernel.org/stable/c/569c9d9ea6648d099187527b93982f406ddcebc0
- https://git.kernel.org/stable/c/6eed6d3cd19ff3cfa83aeceed86da14abaf7417b
- https://git.kernel.org/stable/c/73e7c8ca6ad76f29b2c99c20845a6f3b203ff0c6
- https://git.kernel.org/stable/c/b86762dbe19a62e785c189f313cda5b989931f37
- https://git.kernel.org/stable/c/d66fc4826127c82f99c4033380f8e93833d331c7