Junglewise Threat Intelligence

CVE-2024-40961: Linux Kernel NULL pointer dereference in fib6_nh_init

CVE-2024-40961 · Severity: medium · CVSS 5.5 · Published 2024-07-12

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's IPv6 networking component could allow a local user to crash the system. The issue occurs when the system attempts to initialize certain network routing paths while IPv6 is disabled on a specific interface. This can lead to a system-wide denial of service, impacting availability and ongoing operations.

Technical details

A NULL pointer dereference exists in the Linux kernel's IPv6 stack within the 'fib6_nh_init()' function in 'net/ipv6/route.c'. The vulnerability is triggered when 'in6_dev_get()' returns NULL during gateway validation ('ip6_validate_gw'), which occurs if IPv6 is disabled on a nexthop device. An attacker with local access can trigger this by performing specific socket IOCTL operations (e.g., 'ipv6_route_ioctl') that attempt to add a route using a device where IPv6 is not properly initialized or is disabled. This results in a general protection fault and kernel panic. Patches have been released across multiple stable kernel branches to add the necessary NULL check for the 'idev' pointer.

Affected products

  • Linux Linux Kernel 4.17 to 5.4.279, 5.5 to 5.10.221, 5.11 to 5.15.162, 5.16 to 6.1.96, 6.2 to 6.6.36, 6.7 to 6.9.7, 6.10-rc1 to 6.10-rc4

Timeline

  • 2024-06-14: patched: Initial patch authored by Eric Dumazet
  • 2024-07-12: advisory: CVE published to NVD

References

Related threats