Junglewise Threat Intelligence

CVE-2024-42281: Linux Kernel BPF denial of service in bpf_skb_net_grow

CVE-2024-42281 · Severity: medium · CVSS 5.5 · Published 2024-08-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash. The issue occurs when the system processes specific types of network data packets modified by BPF programs. This could lead to a denial-of-service condition, impacting the availability of the affected system.

Technical details

The vulnerability exists in the BPF subsystem of the Linux kernel, specifically within the bpf_skb_net_grow function in net/core/filter.c. When the bpf_skb_adjust_room helper is used to increase header size, the Maximum Segment Size (MSS) may be downgraded. If the socket buffer (skb) contains a frag_list, this downgrade can trigger a BUG_ON() during subsequent segmentation. An attacker with local access could potentially exploit this to cause a kernel panic and denial of service. The fix involves linearizing the skb when downgrading gso_size if a frag_list is present. Patches have been released for multiple stable kernel branches.

Affected products

  • Linux Linux Kernel 4.13 to 5.4.282, 5.5 to 5.10.224, 5.11 to 5.15.165, 5.16 to 6.1.103, 6.2 to 6.6.44, 6.7 to 6.10.3

Timeline

  • 2024-08-03: patched: Initial patches committed to stable trees.
  • 2024-08-17: disclosed: CVE-2024-42281 published.

References

Related threats