Executive brief
A vulnerability exists in the Linux kernel's IPv6 networking component, which manages how the system communicates over modern internet protocols. An attacker with local access to the system could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive information. This issue affects the stability and security of servers and workstations running impacted versions of the Linux operating system.
Technical details
A use-after-free (UAF) vulnerability exists in the ip6_send_skb() function within the Linux kernel's IPv6 stack. The issue arises because the routing table (rt) pointer can be dereferenced after ip6_local_out() has returned, at which point the memory may have already been freed. This occurs because the code fails to properly hold the RCU read lock during certain socket operations. A local attacker can trigger this race condition via crafted raw IPv6 socket messages, potentially leading to a kernel crash (DoS) or arbitrary code execution. Patches have been released across multiple stable kernel branches to ensure proper RCU locking.
Affected products
- Linux Linux Kernel 6.11-rc3 and earlier versions
Timeline
- 2024-08-20: patched: Initial fix authored by Eric Dumazet
- 2024-09-04: advisory: CVE-2024-44987 published
References
- https://git.kernel.org/stable/c/24e93695b1239fbe4c31e224372be77f82dab69a
- https://git.kernel.org/stable/c/571567e0277008459750f0728f246086b2659429
- https://git.kernel.org/stable/c/9a3e55afa95ed4ac9eda112d4f918af645d72f25
- https://git.kernel.org/stable/c/af1dde074ee2ed7dd5bdca4e7e8ba17f44e7b011
- https://git.kernel.org/stable/c/cb5880a0de12c7f618d2bdd84e2d985f1e06ed7e
- https://git.kernel.org/stable/c/ce2f6cfab2c637d0bd9762104023a15d0ab7c0a8
- https://git.kernel.org/stable/c/e44bd76dd072756e674f45c5be00153f4ded68b2